Dzzoffice

14 CVEs across 1 Dzzoffice products. Browse Dzzoffice vulnerabilities, severities, and proof-of-concept exploits.

Dzzoffice products with known CVEs

ProductCVEs
Dzzoffice14
Dzzoffice CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-63693Medium5.42025-11-18The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple co…
CVE-2025-63695Critical9.82025-11-18DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.
CVE-2025-63694Critical9.82025-11-18DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.
CVE-2024-41376High8.82024-08-05dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.
CVE-2024-29273Medium6.12024-03-22There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.
CVE-2023-39853Medium6.52024-01-06SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Netw…
CVE-2021-30205Medium5.32023-06-27Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated attackers to browse departments a…
CVE-2021-30203Medium6.12023-06-27A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute arbitrary web scripts or HTM…
CVE-2022-43340High8.82022-10-27A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular…
CVE-2021-43673Medium6.12021-12-03dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of the exit function is printed for the user…
CVE-2021-40292Medium5.42021-10-12A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter.
CVE-2021-40191Medium5.42021-10-11Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in webroot/dzz/attach/Up…
CVE-2020-19703Medium6.12021-08-26A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted p…
CVE-2021-3318Medium6.12021-01-27attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.