Skip to content
Noroxi

dzzoffice records

14 published records for vendor dzzoffice.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 21
  2. 22
  3. 23
  4. 24
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

14 records
  • CVE-2025-63695
    39Monitor

    DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.

    CriticalCVSS 9.8No exploitEPSS 0%

    dzzoffice · dzzofficeNov 18, 2025

  • CVE-2025-63694
    39Monitor

    DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.

    CriticalCVSS 9.8No exploitEPSS 0%

    dzzoffice · dzzofficeNov 18, 2025

  • CVE-2024-41376
    35Monitor

    dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.

    HighCVSS 8.8No exploitEPSS 0%

    dzzoffice · dzzofficeAug 5, 2024

  • CVE-2022-43340
    35Monitor

    A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator

    HighCVSS 8.8No exploitEPSS 0%

    dzzoffice · dzzofficeOct 27, 2022

  • CVE-2023-39853
    26Monitor

    SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent par

    MediumCVSS 6.5No exploitEPSS 0%

    dzzoffice · dzzofficeJan 6, 2024

  • CVE-2021-3318
    25Monitor

    attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.

    MediumCVSS 6.1Proof of conceptEPSS 2%

    dzzoffice · dzzofficeJan 27, 2021

  • CVE-2020-19703
    24Monitor

    A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or H

    MediumCVSS 6.1No exploitEPSS 0%

    dzzoffice · dzzofficeAug 25, 2021

  • CVE-2021-43673
    24Monitor

    dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php.

    MediumCVSS 6.1No exploitEPSS 0%

    dzzoffice · dzzofficeDec 3, 2021

  • CVE-2021-30203
    24Monitor

    A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary

    MediumCVSS 6.1Proof of conceptEPSS 0%

    dzzoffice · dzzofficeJun 27, 2023

  • CVE-2024-29273
    24Monitor

    There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.

    MediumCVSS 6.1No exploitEPSS 0%

    dzzoffice · dzzofficeMar 22, 2024

  • CVE-2021-40292
    21Monitor

    A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter.

    MediumCVSS 5.4No exploitEPSS 0%

    dzzoffice · dzzofficeOct 12, 2021

  • CVE-2021-30205
    21Monitor

    Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to b

    MediumCVSS 5.3No exploitEPSS 0%

    dzzoffice · dzzofficeJun 27, 2023

  • CVE-2021-40191
    21Monitor

    Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in we

    MediumCVSS 5.4No exploitEPSS 0%

    dzzoffice · dzzofficeOct 11, 2021

  • CVE-2025-63693
    21Monitor

    The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable

    MediumCVSS 5.4No exploitEPSS 0%

    dzzoffice · dzzofficeNov 18, 2025