Total
86 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-9309 | 1 Zzcms | 1 Zzcms | 2024-02-28 | 5.0 MEDIUM | 9.8 CRITICAL |
| An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dl_sendsms.php request. | |||||
| CVE-2018-8967 | 1 Zzcms | 1 Zzcms | 2024-02-28 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request. | |||||
| CVE-2018-8966 | 1 Zzcms | 1 Zzcms | 2024-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php. | |||||
| CVE-2018-7434 | 1 Zzcms | 1 Zzcms | 2024-02-28 | 5.0 MEDIUM | 5.3 MEDIUM |
| zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php. | |||||
| CVE-2018-8965 | 1 Zzcms | 1 Zzcms | 2024-02-28 | 6.4 MEDIUM | 7.5 HIGH |
| An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. | |||||
| CVE-2018-9331 | 1 Zzcms | 1 Zzcms | 2024-02-28 | 6.4 MEDIUM | 7.5 HIGH |
| An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock. | |||||