CVE-2025-14837 | Medium | 4.7 | 2025-12-18 | A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Websit… |
CVE-2025-14836 | Low | 2.7 | 2025-12-17 | A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Stora… |
CVE-2025-13171 | Medium | 6.3 | 2025-11-14 | A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of the argument keyword l… |
CVE-2025-1949 | Medium | 4.3 | 2025-03-04 | A vulnerability, which was classified as problematic, has been found in ZZCMS 2025. This issue affects some unknown processing of the file /3/ucenter_api/code/… |
CVE-2025-22957 | Critical | 9.8 | 2025-01-31 | A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication. This vulnerability co… |
CVE-2025-0565 | High | 7.3 | 2025-01-19 | A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipu… |
CVE-2024-52724 | Critical | 9.8 | 2024-12-02 | ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php. |
CVE-2024-11242 | Medium | 4.7 | 2024-11-15 | A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/ad_list.php?act… |
CVE-2024-11130 | Low | 2.4 | 2024-11-12 | A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/msg.ph… |
CVE-2024-10293 | Medium | 6.3 | 2024-10-23 | A vulnerability was found in ZZCMS 2023. It has been classified as critical. Affected is the function Ebak_SetGotoPak of the file 3/Ebbak5.1/upload/class/funct… |
CVE-2024-10292 | Medium | 6.3 | 2024-10-23 | A vulnerability was found in ZZCMS 2023 and classified as critical. This issue affects some unknown processing of the file 3/Ebak5.1/upload/ChangeTable.php. Th… |
CVE-2024-10291 | Medium | 6.3 | 2024-10-23 | A vulnerability has been found in ZZCMS 2023 and classified as critical. This vulnerability affects the function Ebak_DoExecSQL/Ebak_DotranExecutSQL of the fil… |
CVE-2024-10290 | Medium | 5.3 | 2024-10-23 | A vulnerability, which was classified as problematic, was found in ZZCMS 2023. This affects an unknown part of the file 3/qq-connect2.0/API/com/inc.php. The ma… |
CVE-2024-44821 | Medium | 5.3 | 2024-09-04 | ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php. The checkyzm function does not properly refresh the captcha value… |
CVE-2024-44818 | Medium | 5.4 | 2024-09-04 | Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the HTTP_Referer header of the caina… |
CVE-2024-44817 | High | 8.8 | 2024-09-04 | SQL Injection vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the id parameter in the adv2.php component. |
CVE-2024-44820 | Medium | 6.1 | 2024-09-04 | A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file located at /3/E_bak5.1/upload/. When accessed wit… |
CVE-2024-44819 | Medium | 6.1 | 2024-09-04 | Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script to the pagename par… |
CVE-2024-7927 | High | 7.3 | 2024-08-19 | A vulnerability classified as critical was found in ZZCMS 2023. Affected by this vulnerability is an unknown functionality of the file /admin/class.php?dowhat=… |
CVE-2024-7926 | High | 7.3 | 2024-08-19 | A vulnerability classified as critical has been found in ZZCMS 2023. Affected is an unknown function of the file /admin/about_edit.php?action=modify. The manip… |
CVE-2024-7925 | Medium | 4.3 | 2024-08-19 | A vulnerability was found in ZZCMS 2023. It has been rated as problematic. This issue affects some unknown processing of the file 3/E_bak5.1/upload/eginfo.php… |
CVE-2024-7924 | Medium | 5.3 | 2024-08-19 | A vulnerability was found in ZZCMS 2023. It has been declared as critical. This vulnerability affects unknown code of the file /I/list.php. The manipulation of… |
CVE-2024-43011 | Medium | 4.9 | 2024-08-16 | An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization… |
CVE-2024-43009 | Medium | 4.7 | 2024-08-16 | A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value… |
CVE-2024-43006 | Medium | 5.4 | 2024-08-16 | A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sendin… |
CVE-2024-43005 | Medium | 4.7 | 2024-08-16 | A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the conte… |
CVE-2023-50104 | Critical | 9.8 | 2023-12-29 | ZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privileges and execute ar… |
CVE-2023-42398 | Critical | 9.8 | 2023-09-15 | An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php. |
CVE-2023-36162 | High | 8.8 | 2023-07-03 | Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php. |
CVE-2022-44361 | Medium | 5.4 | 2022-12-07 | An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php. |
CVE-2022-40447 | High | 7.2 | 2022-09-22 | ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojia_list.php. |
CVE-2022-40446 | High | 7.2 | 2022-09-22 | ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=. |
CVE-2022-40444 | Medium | 5.3 | 2022-09-22 | ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server. |
CVE-2022-40443 | Medium | 5.3 | 2022-09-22 | An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php. |
CVE-2019-12359 | High | 7.2 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the i… |
CVE-2019-12358 | High | 8.8 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cook… |
CVE-2019-12357 | High | 7.2 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php (when the attacker has admin authority) via the id paramete… |
CVE-2019-12356 | High | 8.8 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_download.php (when the attacker has dls_download authority) via the… |
CVE-2019-12355 | High | 8.8 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_print.php (when the attacker has dls_print authority) via the id par… |
CVE-2019-12354 | High | 7.2 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php (when the attacker has admin authority) via the id paramete… |
CVE-2019-12353 | High | 7.2 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dl_sendmail.php (when the attacker has admin authority) via the id para… |
CVE-2019-12352 | High | 8.8 | 2022-06-17 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendmail.php (when the attacker has dls_print authority) via a dlid coo… |
CVE-2019-12351 | Critical | 9.8 | 2022-06-02 | An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_print.php via an id parameter value with a trailing comma. |
CVE-2019-12350 | Critical | 9.8 | 2022-06-02 | An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma. |
CVE-2019-12349 | Critical | 9.8 | 2022-06-02 | An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter. |
CVE-2021-46437 | Medium | 4.8 | 2022-04-08 | An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php. |
CVE-2021-46436 | High | 7.2 | 2022-04-08 | An issue was discovered in ZZCMS 2021. There is a SQL injection vulnerability in ad_manage.php. |
CVE-2021-45347 | High | 7.5 | 2022-02-14 | An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use… |
CVE-2021-45286 | Medium | 5.3 | 2022-02-09 | Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php. |
CVE-2021-42945 | Critical | 9.8 | 2021-12-15 | A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php. |
CVE-2020-19042 | Medium | 6.1 | 2021-12-13 | Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php. |
CVE-2021-43703 | Critical | 9.8 | 2021-12-09 | An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the adm… |
CVE-2021-40282 | High | 8.8 | 2021-12-09 | An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary users. |
CVE-2021-40281 | High | 8.8 | 2021-12-09 | An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users. |
CVE-2021-40280 | High | 7.2 | 2021-12-09 | An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php. |
CVE-2021-40279 | High | 7.2 | 2021-12-09 | An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php. |
CVE-2020-19961 | High | 7.5 | 2021-10-14 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php. |
CVE-2020-19960 | High | 7.5 | 2021-10-14 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl… |
CVE-2020-19959 | High | 7.5 | 2021-10-14 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl… |
CVE-2020-19957 | High | 7.5 | 2021-10-14 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_p… |
CVE-2020-19822 | High | 7.2 | 2021-08-26 | A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title"… |
CVE-2020-35973 | Medium | 5.4 | 2021-06-03 | An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php. |
CVE-2019-12348 | Critical | 9.8 | 2021-05-24 | An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter. |
CVE-2020-21342 | High | 7.5 | 2021-05-13 | Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php. |
CVE-2020-23426 | Critical | 9.8 | 2021-04-08 | zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further at… |
CVE-2020-23630 | High | 8.8 | 2021-01-11 | A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection). |
CVE-2020-20285 | Medium | 5.4 | 2020-12-18 | There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php |
CVE-2019-1010153 | Critical | 9.8 | 2019-07-23 | zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php. |
CVE-2019-1010152 | Critical | 9.8 | 2019-07-23 | zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80. |
CVE-2019-1010150 | Critical | 9.8 | 2019-07-23 | zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php. |
CVE-2019-1010149 | Critical | 9.8 | 2019-07-23 | zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence… |
CVE-2019-1010148 | Critical | 9.8 | 2019-07-23 | zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution. |
CVE-2019-1010151 | Critical | 9.8 | 2019-07-19 | zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php. |
CVE-2018-17416 | High | 7.2 | 2019-03-07 | A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter. |
CVE-2018-17415 | High | 8.8 | 2019-03-07 | zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter. |
CVE-2018-17414 | High | 8.8 | 2019-03-07 | zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter. |
CVE-2018-17413 | Medium | 6.1 | 2019-03-07 | XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter. |
CVE-2018-17412 | Critical | 9.8 | 2019-03-07 | zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header. |
CVE-2019-9078 | Medium | 5.4 | 2019-02-24 | zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT. |
CVE-2019-8411 | High | 7.5 | 2019-02-17 | admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal. |
CVE-2018-18792 | Critical | 9.8 | 2018-10-29 | An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs_list.php via a pxzs cookie. |
CVE-2018-18791 | Critical | 9.8 | 2018-10-29 | An issue was discovered in zzcms 8.3. SQL Injection exists in zs/search.php via a pxzs cookie. |
CVE-2018-18790 | High | 7.2 | 2018-10-29 | An issue was discovered in zzcms 8.3. SQL Injection exists in admin/special_add.php via a zxbigclassid cookie. (This needs an admin user login.) |
CVE-2018-18789 | Critical | 9.8 | 2018-10-29 | An issue was discovered in zzcms 8.3. SQL Injection exists in zt/top.php via a Host HTTP header to zt/news.php. |
CVE-2018-18788 | High | 7.2 | 2018-10-29 | An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. (This needs an admin user login.) |
CVE-2018-18787 | Critical | 9.8 | 2018-10-29 | An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs.php via a pxzs cookie. |
CVE-2018-18786 | Critical | 9.8 | 2018-10-29 | An issue was discovered in zzcms 8.3. SQL Injection exists in ajax/zs.php via a pxzs cookie. |
CVE-2018-18785 | Critical | 9.8 | 2018-10-29 | An issue was discovered in zzcms 8.3. SQL Injection exists in zs/subzs.php with a zzcmscpid cookie to zs/search.php. |
CVE-2018-18784 | High | 7.2 | 2018-10-29 | An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. (This needs an admin user login.) |
CVE-2018-17798 | Medium | 6.5 | 2018-09-30 | An issue was discovered in zzcms 8.3. user/ztconfig.php allows remote attackers to delete arbitrary files via an absolute pathname in the oldimg parameter in a… |
CVE-2018-17797 | Medium | 6.5 | 2018-09-30 | An issue was discovered in zzcms 8.3. user/zssave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg paramet… |
CVE-2018-17136 | Critical | 9.8 | 2018-09-17 | zzcms 8.3 contains a SQL Injection vulnerability in /user/check.php via a Client-Ip HTTP header. |
CVE-2018-16344 | High | 7.5 | 2018-09-02 | An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be… |
CVE-2018-1000653 | Critical | 9.8 | 2018-08-20 | zzcms version 8.3 and earlier contains a SQL Injection vulnerability in zt/top.php line 5 that can result in could be attacked by sql injection in zzcms in ngi… |
CVE-2018-14963 | High | 8.8 | 2018-08-06 | zzcms 8.3 has CSRF via the admin/adminadd.php?action=add URI. |
CVE-2018-14962 | Medium | 5.4 | 2018-08-06 | zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php. |
CVE-2018-14961 | Critical | 9.8 | 2018-08-06 | dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter. |
CVE-2018-13116 | Critical | 9.8 | 2018-07-03 | /user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcms_ask table. |
CVE-2018-13056 | High | 7.5 | 2018-07-02 | An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table… |
CVE-2018-9331 | High | 7.5 | 2018-04-07 | An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter… |