| CVE-2020-19822 | ALTO7.2 | A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters. | 26/08/2021 |
| CVE-2020-35973 | MEDIO5.4 | An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php. | 03/06/2021 |
| CVE-2019-12348 | CRÍTICO9.8 | An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter. | 24/05/2021 |
| CVE-2020-21342 | ALTO7.5 | Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php. | 13/05/2021 |
| CVE-2020-23426 | CRÍTICO9.8 | zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF. | 08/04/2021 |
| CVE-2020-23630 | ALTO8.8 | A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection). | 11/01/2021 |
| CVE-2020-20285 | MEDIO5.4 | There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php | 18/12/2020 |
| CVE-2019-1010153 | CRÍTICO9.8 | zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php. | 23/07/2019 |
| CVE-2019-1010152 | CRÍTICO9.8 | zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80. | 23/07/2019 |
| CVE-2019-1010150 | CRÍTICO9.8 | zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php. | 23/07/2019 |
| CVE-2019-1010149 | CRÍTICO9.8 | zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php. | 23/07/2019 |
| CVE-2019-1010148 | CRÍTICO9.8 | zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution. | 23/07/2019 |
| CVE-2019-1010151 | CRÍTICO9.8 | zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php. | 19/07/2019 |
| CVE-2018-17416 | ALTO7.2 | A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter. | 07/03/2019 |
| CVE-2018-17415 | ALTO8.8 | zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter. | 07/03/2019 |
| CVE-2018-17414 | ALTO8.8 | zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter. | 07/03/2019 |
| CVE-2018-17413 | MEDIO6.1 | XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter. | 07/03/2019 |
| CVE-2018-17412 | CRÍTICO9.8 | zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header. | 07/03/2019 |
| CVE-2019-9078 | MEDIO5.4 | zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT. | 24/02/2019 |
| CVE-2019-8411 | ALTO7.5 | admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal. | 17/02/2019 |