zzcms records
107 published records for vendor zzcms.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 4
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')50
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')17
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')16
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')4
- CWE-434 Unrestricted Upload of File with Dangerous Type3
- CWE-862 Missing Authorization3
The weakness classes this vendor ships most often: where to look.
CWEAll records
107 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2020-23426No exploit | zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify zzcms · zzcms · CWE-352 | Critical9.8 | — | 3.7% | Apr 8, 2021 |
40Plan | CVE-2019-1010150No exploit | zzcms 8.3 and earlier is affected by: File Delete to Code Execution.zzcms · zzcms · CWE-862 | Critical9.8 | — | 2.4% | Jul 23, 2019 |
40Plan | CVE-2019-1010152No exploit | zzcms 8.3 and earlier is affected by: File Delete to Code Execution.zzcms · zzcms · CWE-862 | Critical9.8 | — | 2.4% | Jul 23, 2019 |
40Plan | CVE-2019-1010149No exploit | zzcms version 8.3 and earlier is affected by: File Delete to Code Execution.zzcms · zzcms · CWE-862 | Critical9.8 | — | 2.4% | Jul 23, 2019 |
40Plan | CVE-2019-1010148No exploit | zzcms version 8.3 and earlier is affected by: SQL Injection.zzcms · zzcms · CWE-89 | Critical9.8 | — | 2.3% | Jul 23, 2019 |
40Plan | CVE-2019-1010151No exploit | zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell.zzcms · zzmcms · CWE-22 | Critical9.8 | — | 2.0% | Jul 19, 2019 |
40Plan | CVE-2018-9309No exploit | An issue was discovered in zzcms 8.2.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.8% | Apr 4, 2018 |
40Plan | CVE-2018-8967No exploit | An issue was discovered in zzcms 8.2.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.8% | Mar 24, 2018 |
40Plan | CVE-2021-43703No exploit | An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php.zzcms · zzcms | Critical9.8 | — | 1.8% | Dec 9, 2021 |
40Plan | CVE-2018-14961No exploit | dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.8% | Aug 6, 2018 |
40Plan | CVE-2023-42398No exploit | An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in cozzcms · zzcms · CWE-918 | Critical9.8 | — | 1.7% | Sep 15, 2023 |
39Monitor | CVE-2019-12348No exploit | An issue was discovered in zzcms 2019.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.7% | May 24, 2021 |
39Monitor | CVE-2018-18791No exploit | An issue was discovered in zzcms 8.3.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.5% | Oct 29, 2018 |
39Monitor | CVE-2019-1010153No exploit | zzcms 8.3 and earlier is affected by: SQL Injection.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.5% | Jul 23, 2019 |
39Monitor | CVE-2018-17412No exploit | zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.5% | Mar 7, 2019 |
39Monitor | CVE-2019-12349No exploit | An issue was discovered in zzcms 2019.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.4% | Jun 2, 2022 |
39Monitor | CVE-2019-12350No exploit | An issue was discovered in zzcms 2019.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.4% | Jun 2, 2022 |
39Monitor | CVE-2019-12351No exploit | An issue was discovered in zzcms 2019.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.4% | Jun 2, 2022 |
39Monitor | CVE-2018-18792No exploit | An issue was discovered in zzcms 8.3.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.2% | Oct 29, 2018 |
39Monitor | CVE-2018-18789No exploit | An issue was discovered in zzcms 8.3.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.2% | Oct 29, 2018 |
39Monitor | CVE-2018-1000653No exploit | zzcms version 8.3 and earlier contains a SQL Injection vulnerability in zt/top.php line 5 that can result in could be attacked by sql injectzzcms · zzcms · CWE-89 | Critical9.8 | — | 1.2% | Aug 20, 2018 |
39Monitor | CVE-2018-18787No exploit | An issue was discovered in zzcms 8.3.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.2% | Oct 29, 2018 |
39Monitor | CVE-2018-18786No exploit | An issue was discovered in zzcms 8.3.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.2% | Oct 29, 2018 |
39Monitor | CVE-2018-18785No exploit | An issue was discovered in zzcms 8.3.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.2% | Oct 29, 2018 |
39Monitor | CVE-2018-17136No exploit | zzcms 8.3 contains a SQL Injection vulnerability in /user/check.php via a Client-Ip HTTP header.zzcms · zzcms · CWE-89 | Critical9.8 | — | 1.2% | Sep 17, 2018 |
- CVE-2020-2342640Plan
zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify
CriticalCVSS 9.8No exploitEPSS 4%zzcms · zzcmsApr 8, 2021
- CVE-2019-101015040Plan
zzcms 8.3 and earlier is affected by: File Delete to Code Execution.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsJul 23, 2019
- CVE-2019-101015240Plan
zzcms 8.3 and earlier is affected by: File Delete to Code Execution.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsJul 23, 2019
- CVE-2019-101014940Plan
zzcms version 8.3 and earlier is affected by: File Delete to Code Execution.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsJul 23, 2019
- CVE-2019-101014840Plan
zzcms version 8.3 and earlier is affected by: SQL Injection.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsJul 23, 2019
- CVE-2019-101015140Plan
zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzmcmsJul 19, 2019
- CVE-2018-930940Plan
An issue was discovered in zzcms 8.2.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsApr 4, 2018
- CVE-2018-896740Plan
An issue was discovered in zzcms 8.2.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsMar 24, 2018
- CVE-2021-4370340Plan
An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsDec 9, 2021
- CVE-2018-1496140Plan
dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsAug 6, 2018
- CVE-2023-4239840Plan
An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in co
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsSep 15, 2023
- CVE-2019-1234839Monitor
An issue was discovered in zzcms 2019.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsMay 24, 2021
- CVE-2018-1879139Monitor
An issue was discovered in zzcms 8.3.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsOct 29, 2018
- CVE-2019-101015339Monitor
zzcms 8.3 and earlier is affected by: SQL Injection.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsJul 23, 2019
- CVE-2018-1741239Monitor
zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.
CriticalCVSS 9.8No exploitEPSS 2%zzcms · zzcmsMar 7, 2019
- CVE-2019-1234939Monitor
An issue was discovered in zzcms 2019.
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsJun 2, 2022
- CVE-2019-1235039Monitor
An issue was discovered in zzcms 2019.
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsJun 2, 2022
- CVE-2019-1235139Monitor
An issue was discovered in zzcms 2019.
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsJun 2, 2022
- CVE-2018-1879239Monitor
An issue was discovered in zzcms 8.3.
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsOct 29, 2018
- CVE-2018-1878939Monitor
An issue was discovered in zzcms 8.3.
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsOct 29, 2018
- CVE-2018-100065339Monitor
zzcms version 8.3 and earlier contains a SQL Injection vulnerability in zt/top.php line 5 that can result in could be attacked by sql inject
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsAug 20, 2018
- CVE-2018-1878739Monitor
An issue was discovered in zzcms 8.3.
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsOct 29, 2018
- CVE-2018-1878639Monitor
An issue was discovered in zzcms 8.3.
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsOct 29, 2018
- CVE-2018-1878539Monitor
An issue was discovered in zzcms 8.3.
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsOct 29, 2018
- CVE-2018-1713639Monitor
zzcms 8.3 contains a SQL Injection vulnerability in /user/check.php via a Client-Ip HTTP header.
CriticalCVSS 9.8No exploitEPSS 1%zzcms · zzcmsSep 17, 2018