| CVE-2019-12353 | ALTO7.2 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dl_sendmail.php (when the attacker has admin authority) via the id parameter. | 17/06/2022 |
| CVE-2019-12352 | ALTO8.8 | An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendmail.php (when the attacker has dls_print authority) via a dlid cookie. | 17/06/2022 |
| CVE-2019-12351 | CRÍTICO9.8 | An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_print.php via an id parameter value with a trailing comma. | 02/06/2022 |
| CVE-2019-12350 | CRÍTICO9.8 | An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma. | 02/06/2022 |
| CVE-2019-12349 | CRÍTICO9.8 | An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter. | 02/06/2022 |
| CVE-2021-46437 | MEDIO4.8 | An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php. | 08/04/2022 |
| CVE-2021-46436 | ALTO7.2 | An issue was discovered in ZZCMS 2021. There is a SQL injection vulnerability in ad_manage.php. | 08/04/2022 |
| CVE-2021-45347 | ALTO7.5 | An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password. | 14/02/2022 |
| CVE-2021-45286 | MEDIO5.3 | Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php. | 09/02/2022 |
| CVE-2021-42945 | CRÍTICO9.8 | A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php. | 15/12/2021 |
| CVE-2020-19042 | MEDIO6.1 | Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php. | 13/12/2021 |
| CVE-2021-43703 | CRÍTICO9.8 | An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console. | 09/12/2021 |
| CVE-2021-40282 | ALTO8.8 | An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary users. | 09/12/2021 |
| CVE-2021-40281 | ALTO8.8 | An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users. | 09/12/2021 |
| CVE-2021-40280 | ALTO7.2 | An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php. | 09/12/2021 |
| CVE-2021-40279 | ALTO7.2 | An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php. | 09/12/2021 |
| CVE-2020-19961 | ALTO7.5 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php. | 14/10/2021 |
| CVE-2020-19960 | ALTO7.5 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendsms.php page cookie. | 14/10/2021 |
| CVE-2020-19959 | ALTO7.5 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendmail.php page cookie. | 14/10/2021 |
| CVE-2020-19957 | ALTO7.5 | A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_print.php page. | 14/10/2021 |