Vulnerabilities > Zzcms

DATE CVE VULNERABILITY TITLE RISK
2021-10-14 CVE-2020-19957 SQL Injection vulnerability in Zzcms 2019
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_print.php page.
network
low complexity
zzcms CWE-89
5.0
2021-10-14 CVE-2020-19959 SQL Injection vulnerability in Zzcms 2019
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendmail.php page cookie.
network
low complexity
zzcms CWE-89
5.0
2021-10-14 CVE-2020-19960 SQL Injection vulnerability in Zzcms 2019
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendsms.php page cookie.
network
low complexity
zzcms CWE-89
5.0
2021-10-14 CVE-2020-19961 SQL Injection vulnerability in Zzcms 2019
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php.
network
low complexity
zzcms CWE-89
5.0
2021-08-26 CVE-2020-19822 Code Injection vulnerability in Zzcms 2018
A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters.
network
low complexity
zzcms CWE-94
6.5
2021-06-03 CVE-2020-35973 Cross-site Scripting vulnerability in Zzcms 2020
An issue was discovered in zzcms2020.
network
zzcms CWE-79
3.5
2021-05-24 CVE-2019-12348 SQL Injection vulnerability in Zzcms 2019
An issue was discovered in zzcms 2019.
network
low complexity
zzcms CWE-89
7.5
2021-05-13 CVE-2020-21342 Incorrect Default Permissions vulnerability in Zzcms 201910
Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.
network
low complexity
zzcms CWE-276
5.0
2021-04-08 CVE-2020-23426 Improper Privilege Management vulnerability in Zzcms 201910
zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF.
network
low complexity
zzcms CWE-269
7.5
2021-01-11 CVE-2020-23630 SQL Injection vulnerability in Zzcms 201910
A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).
network
low complexity
zzcms CWE-89
6.5