Filtered by vendor Zzcms Subscriptions
Total 101 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-12351 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_print.php via an id parameter value with a trailing comma.
CVE-2019-12350 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma.
CVE-2019-12349 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter.
CVE-2019-12348 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.
CVE-2019-1010153 1 Zzcms 1 Zzcms 2024-11-21 N/A
zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php.
CVE-2019-1010152 1 Zzcms 1 Zzcms 2024-11-21 N/A
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80.
CVE-2019-1010151 1 Zzcms 1 Zzmcms 2024-11-21 N/A
zzcms zzmcms 8.3 and earlier is affected by: File Delete to getshell. The impact is: getshell. The component is: /user/ppsave.php.
CVE-2019-1010150 1 Zzcms 1 Zzcms 2024-11-21 N/A
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.
CVE-2019-1010149 1 Zzcms 1 Zzcms 2024-11-21 N/A
zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php.
CVE-2019-1010148 1 Zzcms 1 Zzcms 2024-11-21 N/A
zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution.
CVE-2018-9331 1 Zzcms 1 Zzcms 2024-11-21 7.5 High
An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock.
CVE-2018-9309 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dl_sendsms.php request.
CVE-2018-8969 1 Zzcms 1 Zzcms 2024-11-21 7.5 High
An issue was discovered in zzcms 8.2. user/licence_save.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
CVE-2018-8968 1 Zzcms 1 Zzcms 2024-11-21 7.5 High
An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
CVE-2018-8967 1 Zzcms 1 Zzcms 2024-11-21 9.8 Critical
An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request.
CVE-2018-8966 1 Zzcms 1 Zzcms 2024-11-21 7.5 High
An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.
CVE-2018-8965 1 Zzcms 1 Zzcms 2024-11-21 7.5 High
An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modify request. This can be leveraged for database access by deleting install.lock.
CVE-2018-7434 1 Zzcms 1 Zzcms 2024-11-21 5.3 Medium
zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php.
CVE-2018-18792 1 Zzcms 1 Zzcms 2024-11-21 N/A
An issue was discovered in zzcms 8.3. SQL Injection exists in zs/zs_list.php via a pxzs cookie.
CVE-2018-18791 1 Zzcms 1 Zzcms 2024-11-21 N/A
An issue was discovered in zzcms 8.3. SQL Injection exists in zs/search.php via a pxzs cookie.