Vulnerabilities (CVE)

Filtered by vendor Zzcms Subscribe
Total 91 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2018-18790 1 Zzcms 1 Zzcms 2024-02-28 6.5 MEDIUM 7.2 HIGH
An issue was discovered in zzcms 8.3. SQL Injection exists in admin/special_add.php via a zxbigclassid cookie. (This needs an admin user login.)
CVE-2018-8969 1 Zzcms 1 Zzcms 2024-02-28 6.4 MEDIUM 7.5 HIGH
An issue was discovered in zzcms 8.2. user/licence_save.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
CVE-2018-13056 1 Zzcms 1 Zzcms 2024-02-28 6.4 MEDIUM 7.5 HIGH
An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table and then making an img add request. This can be leveraged for database access by deleting install.lock.
CVE-2018-13116 1 Zzcms 1 Zzcms 2024-02-28 7.5 HIGH 9.8 CRITICAL
/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcms_ask table.
CVE-2018-8968 1 Zzcms 1 Zzcms 2024-02-28 6.4 MEDIUM 7.5 HIGH
An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
CVE-2018-9309 1 Zzcms 1 Zzcms 2024-02-28 5.0 MEDIUM 9.8 CRITICAL
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dl_sendsms.php request.
CVE-2018-8967 1 Zzcms 1 Zzcms 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request.
CVE-2018-8966 1 Zzcms 1 Zzcms 2024-02-28 5.0 MEDIUM 7.5 HIGH
An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.
CVE-2018-7434 1 Zzcms 1 Zzcms 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php.
CVE-2018-8965 1 Zzcms 1 Zzcms 2024-02-28 6.4 MEDIUM 7.5 HIGH
An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
CVE-2018-9331 1 Zzcms 1 Zzcms 2024-02-28 6.4 MEDIUM 7.5 HIGH
An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock.