CVE-2019-25731

Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact

Published Jun 4, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to /gmusic/zuzconsole/___contact, which executes when administrators view messages in the inbox interface.

Analysis

Technical impact

The vulnerability is a persistent cross‑site scripting flaw that allows unauthenticated users to embed and store malicious JavaScript snippets in the contact form fields. These scripts reside in the message database and execute when an administrator opens the message in the inbox interface. This exposure originates from improper input validation on the name, subject, and message parameters of the /gmusic/zuzconsole/___contact endpoint (CWE‑79).

Affected Systems

Affected by this flaw are installations of Zuz Music version 2.1. No other versions are known to be impacted. The vendor is Zuz, and the product is the Zuz Music platform.

Risk and Exploitability

The CVSS score is 5.3, indicating a medium severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to submit a crafted contact request; it does not need admin credentials to inject the payload, but the effect materializes only after an administrator views the message. Consequently, the risk is moderate and primarily concerns admins who routinely access the inbox.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Zuz

Zuz Music

affected

Version	Status	Constraints
`2.1`	affected	—

No data.

Vendor Product Versions

Zuz

Zuz Music

Version	Status	Scheme	Platform
`2.1`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Verify if Zuz has released a security update for Zuz Music 2.1 and apply it when available.
Apply custom server‑side sanitization or escaping for the name, subject, and message fields in the /gmusic/zuzconsole/___contact endpoint.
Restrict the contact form to authenticated users or require administrator approval before messages are stored.
Monitor the admin inbox for unexpected content and review logs for suspicious activity.

Generated by OpenCVE AI on June 5, 2026 at 12:25 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.211% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://codecanyon.net/item/zuz-music-advance-music-platform-system/21633476
https://www.exploit-db.com/exploits/46420
https://www.vulncheck.com/advisories/zuz-music-persistent-cross-site-scripting-via-zuzconsole-contact
https://zuz.host/

History

Jun 10, 2026 1:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}`	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Jun 5, 2026 11:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`	cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`

Jun 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Zuz Zuz zuz Music
Vendors & Products		Zuz Zuz zuz Music

Jun 4, 2026 2:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 4, 2026 1:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to /gmusic/zuzconsole/___contact, which executes when administrators view messages in the inbox interface.
Title		Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact
Weaknesses		CWE-79
References		https://codecanyon.net/item/zuz-music-advance-music-platform-system/21633476 https://www.exploit-db.com/exploits/46420 https://www.vulncheck.com/advisories/zuz-music-persistent-cross-site-scripting-via-zuzconsole-contact https://zuz.host/
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`