zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.
CVSS Score
6.1
EPSS Score
0.001
Published
2023-10-18
ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
CVSS Score
9.8
EPSS Score
0.867
Published
2022-03-23
zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block.
CVSS Score
9.8
EPSS Score
0.219
Published
2021-05-11
A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.
CVSS Score
9.8
EPSS Score
0.005
Published
2021-03-15
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz_template.php.
CVSS Score
9.8
EPSS Score
0.072
Published
2021-02-05
Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackers to execute arbitrary commands.
CVSS Score
9.8
EPSS Score
0.064
Published
2020-12-18
parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed via manipulations such as strtr.
CVSS Score
9.8
EPSS Score
0.02
Published
2019-10-14
ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=news&action=catchimage, as demonstrated by uploading a .htaccess or .php5 file.
CVSS Score
7.5
EPSS Score
0.003
Published
2019-09-23
ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru bypasses an str_ireplace operation.
CVSS Score
9.8
EPSS Score
0.036
Published
2019-09-23
ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if the 192.168.0.1 web server sends the contents of a .php file (i.e., it does not interpret a .php file).
CVSS Score
9.8
EPSS Score
0.008
Published
2019-03-30
Page 1