Skip to content
Noroxi

Cszcms records

30 published records for vendor cszcms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
7
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 21
  3. 22
  4. 23
  5. 24
  6. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

30 records
  • CVE-2019-13086
    49Plan

    core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    cszcms · csz cmsJun 30, 2019

  • CVE-2019-15524
    40Plan

    CSZ CMS 1.2.3 allows arbitrary file upload, as demonstrated by a .php file to admin/filemanager in the File Management Module, which leads t

    CriticalCVSS 9.8No exploitEPSS 3%

    cszcms · csz cmsAug 26, 2019

  • CVE-2024-25414
    39Monitor

    An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafte

    CriticalCVSS 9.8No exploitEPSS 2%

    cszcms · csz cmsFeb 15, 2024

  • CVE-2022-27161
    39Monitor

    Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsers

    CriticalCVSS 9.8No exploitEPSS 1%

    cszcms · csz cmsApr 12, 2022

  • CVE-2020-21250
    39Monitor

    CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY_Security.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    cszcms · csz cmsOct 27, 2021

  • CVE-2022-27163
    39Monitor

    CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser

    CriticalCVSS 9.8No exploitEPSS 1%

    cszcms · csz cmsApr 12, 2022

  • CVE-2022-27165
    39Monitor

    CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus

    CriticalCVSS 9.8No exploitEPSS 1%

    cszcms · csz cmsApr 12, 2022

  • CVE-2022-27164
    39Monitor

    CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers

    CriticalCVSS 9.8No exploitEPSS 1%

    cszcms · csz cmsApr 12, 2022

  • CVE-2022-27162
    39Monitor

    CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser

    CriticalCVSS 9.8No exploitEPSS 1%

    cszcms · csz cmsApr 12, 2022

  • CVE-2024-58307
    37Monitor

    CSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint

    CriticalCVSS 9.3No exploitEPSS 1%

    cszcms · csz cmsDec 11, 2025

  • CVE-2021-37144
    36Monitor

    CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion.

    CriticalCVSS 9.1No exploitEPSS 1%

    cszcms · csz cmsJul 30, 2021

  • CVE-2020-19786
    35Monitor

    File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP fi

    HighCVSS 8.8No exploitEPSS 1%

    cszcms · csz cmsMar 23, 2023

  • CVE-2019-7566
    35Monitor

    CSZ CMS 1.1.8 has CSRF via admin/users/new/add.

    HighCVSS 8.8No exploitEPSS 1%

    cszcms · csz cmsFeb 7, 2019

  • CVE-2022-28997
    31Monitor

    CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive data via a local fil

    HighCVSS 7.5No exploitEPSS 2%

    cszcms · cszcmsMay 23, 2022

  • CVE-2021-43701
    27Monitor

    CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS

    MediumCVSS 6.5Proof of conceptEPSS 3%

    cszcms · csz cmsMar 29, 2022

  • CVE-2025-29083
    26Monitor

    SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Plugin

    MediumCVSS 6.5No exploitEPSS 0%

    cszcms · csz cmsSep 23, 2025

  • CVE-2025-29084
    26Monitor

    SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile function in the Upgrad

    MediumCVSS 6.5No exploitEPSS 0%

    cszcms · csz cmsSep 23, 2025

  • CVE-2023-38910
    24Monitor

    CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted pay

    MediumCVSS 6.1No exploitEPSS 0%

    cszcms · csz cmsAug 18, 2023

  • CVE-2024-27734
    24Monitor

    A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name f

    MediumCVSS 6.1No exploitEPSS 0%

    cszcms · csz cmsMar 1, 2024

  • CVE-2023-41601
    24Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in install/index.php of CSZ CMS v1.3.0 allow attackers to execute arbitrary web scripts

    MediumCVSS 6.1No exploitEPSS 0%

    cszcms · csz cmsSep 6, 2023

  • CVE-2024-27752
    21Monitor

    Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the Default Keyword field in th

    MediumCVSS 5.4No exploitEPSS 1%

    cszcms · csz cmsApr 19, 2024

  • CVE-2021-3224
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter.

    MediumCVSS 5.4No exploitEPSS 1%

    cszcms · csz cmsMar 10, 2021

  • CVE-2021-26776
    21Monitor

    CSZ CMS 1.2.9 is affected by a cross-site scripting (XSS) vulnerability in multiple pages through the field name.

    MediumCVSS 5.4No exploitEPSS 1%

    cszcms · csz cmsMar 11, 2021

  • CVE-2023-39599
    21Monitor

    Cross-Site Scripting (XSS) vulnerability in CSZ CMS v.1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Social S

    MediumCVSS 5.4No exploitEPSS 1%

    cszcms · csz cmsAug 22, 2023

  • CVE-2023-38911
    21Monitor

    A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery

    MediumCVSS 5.4No exploitEPSS 0%

    cszcms · csz cmsAug 18, 2023