Filtered by vendor Zzcms
Subscriptions
Filtered by product Zzcms
Subscriptions
Total
98 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-14961 | 1 Zzcms | 1 Zzcms | 2024-08-05 | N/A |
| dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter. | ||||
| CVE-2018-13116 | 1 Zzcms | 1 Zzcms | 2024-08-05 | N/A |
| /user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcms_ask table. | ||||
| CVE-2018-13056 | 1 Zzcms | 1 Zzcms | 2024-08-05 | N/A |
| An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table and then making an img add request. This can be leveraged for database access by deleting install.lock. | ||||
| CVE-2018-9331 | 1 Zzcms | 1 Zzcms | 2024-08-05 | 7.5 High |
| An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock. | ||||
| CVE-2018-9309 | 1 Zzcms | 1 Zzcms | 2024-08-05 | 9.8 Critical |
| An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dl_sendsms.php request. | ||||
| CVE-2018-8968 | 1 Zzcms | 1 Zzcms | 2024-08-05 | 7.5 High |
| An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. | ||||
| CVE-2018-8966 | 1 Zzcms | 1 Zzcms | 2024-08-05 | 7.5 High |
| An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php. | ||||
| CVE-2018-8965 | 1 Zzcms | 1 Zzcms | 2024-08-05 | 7.5 High |
| An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. | ||||
| CVE-2018-8967 | 1 Zzcms | 1 Zzcms | 2024-08-05 | 9.8 Critical |
| An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request. | ||||
| CVE-2018-8969 | 1 Zzcms | 1 Zzcms | 2024-08-05 | 7.5 High |
| An issue was discovered in zzcms 8.2. user/licence_save.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock. | ||||
| CVE-2018-7434 | 1 Zzcms | 1 Zzcms | 2024-08-05 | 5.3 Medium |
| zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php. | ||||
| CVE-2019-1010153 | 1 Zzcms | 1 Zzcms | 2024-08-05 | N/A |
| zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php. | ||||
| CVE-2019-1010152 | 1 Zzcms | 1 Zzcms | 2024-08-05 | N/A |
| zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80. | ||||
| CVE-2019-1010148 | 1 Zzcms | 1 Zzcms | 2024-08-05 | N/A |
| zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution. | ||||
| CVE-2019-1010150 | 1 Zzcms | 1 Zzcms | 2024-08-05 | N/A |
| zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php. | ||||
| CVE-2019-1010149 | 1 Zzcms | 1 Zzcms | 2024-08-05 | N/A |
| zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php. | ||||
| CVE-2019-12358 | 1 Zzcms | 1 Zzcms | 2024-08-04 | 8.8 High |
| An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cookie. | ||||
| CVE-2019-12359 | 1 Zzcms | 1 Zzcms | 2024-08-04 | 7.2 High |
| An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the id parameter. | ||||
| CVE-2019-12349 | 1 Zzcms | 1 Zzcms | 2024-08-04 | 9.8 Critical |
| An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter. | ||||
| CVE-2019-12352 | 1 Zzcms | 1 Zzcms | 2024-08-04 | 8.8 High |
| An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendmail.php (when the attacker has dls_print authority) via a dlid cookie. | ||||