Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
185 results · page 2 of 4
Aug 18, 2023A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouCVE-2023-38911 · Other software · Cszcms · reported by MITREMedium 5.4
A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery parameter in the YouTube URL fields.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2023CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the CVE-2023-38910 · Other software · Cszcms · reported by MITREMedium 6.1
CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing our carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2023SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_model.php.CVE-2020-36136 · Other software · Cskaza · reported by MITREHigh 7.5
SQL Injection vulnerability in cskaza cszcms version 1.2.9, allows attackers to gain sensitive information via pm_sendmail parameter in csz_model.php.
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2023A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL.CVE-2023-34545 · Other software · Cskaza · reported by MITRECritical 9.8
A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL.
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comcszcms.com
Jul 3, 2023Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php.CVE-2023-36162 · Other software · Zzcms · reported by MITREHigh 8.8
Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2023Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.CVE-2020-20502 · Other software · Yzmcms · reported by MITREMedium 6.5
Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function.
- Product
- Yzmcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2023File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP file.CVE-2020-19786 · Other software · Cszcms · reported by MITREHigh 8.8
File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP file.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2022An issue was discovered in ZZCMS 2022.CVE-2022-44361 · Other software · Zzcms · reported by MITREMedium 5.4
An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojia_list.php.CVE-2022-40447 · Other software · Zzcms · reported by MITREHigh 7.2
ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojia_list.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=.CVE-2022-40446 · Other software · Zzcms · reported by MITREHigh 7.2
ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server.CVE-2022-40444 · Other software · Zzcms · reported by MITREMedium 5.3
ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2022An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php.CVE-2022-40443 · Other software · Zzcms · reported by MITREMedium 5.3
An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022An issue was discovered in zzcms 2019.CVE-2019-12359 · Other software · Zzcms · reported by MITREHigh 7.2
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/ztliuyan_sendmail.php (when the attacker has admin authority) via the id parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022An issue was discovered in zzcms 2019.CVE-2019-12358 · Other software · Zzcms · reported by MITREHigh 8.8
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendsms.php (when the attacker has dls_print authority) via a dlid cookie.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022An issue was discovered in zzcms 2019.CVE-2019-12357 · Other software · Zzcms · reported by MITREHigh 7.2
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/deluser.php (when the attacker has admin authority) via the id parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022An issue was discovered in zzcms 2019.CVE-2019-12356 · Other software · Zzcms · reported by MITREHigh 8.8
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_download.php (when the attacker has dls_download authority) via the id parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022An issue was discovered in zzcms 2019.CVE-2019-12355 · Other software · Zzcms · reported by MITREHigh 8.8
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /user/dls_print.php (when the attacker has dls_print authority) via the id parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022An issue was discovered in zzcms 2019.CVE-2019-12354 · Other software · Zzcms · reported by MITREHigh 7.2
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/showbad.php (when the attacker has admin authority) via the id parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022An issue was discovered in zzcms 2019.CVE-2019-12353 · Other software · Zzcms · reported by MITREHigh 7.2
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /admin/dl_sendmail.php (when the attacker has admin authority) via the id parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2022An issue was discovered in zzcms 2019.CVE-2019-12352 · Other software · Zzcms · reported by MITREHigh 8.8
An issue was discovered in zzcms 2019. There is a SQL injection Vulnerability in /dl/dl_sendmail.php (when the attacker has dls_print authority) via a dlid cookie.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022An issue was discovered in zzcms 2019.CVE-2019-12351 · Other software · Zzcms · reported by MITRECritical 9.8
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_print.php via an id parameter value with a trailing comma.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022An issue was discovered in zzcms 2019.CVE-2019-12350 · Other software · Zzcms · reported by MITRECritical 9.8
An issue was discovered in zzcms 2019. SQL Injection exists in dl/dl_download.php via an id parameter value with a trailing comma.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2022An issue was discovered in zzcms 2019.CVE-2019-12349 · Other software · Zzcms · reported by MITRECritical 9.8
An issue was discovered in zzcms 2019. SQL Injection exists in /admin/dl_sendsms.php via the id parameter.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive data via a local file inclusion at /admiCVE-2022-28997 · Other software · Cszcms · reported by MITREHigh 7.5
CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive data via a local file inclusion at /admin/filemanager/connector/.
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordi.imgur.comi.imgur.com
Apr 26, 2022ZCMS v20170206 was discovered to contain a stored cross-site scripting (XSS) vulnerability via index.php?m=home&c=message&a=add.CVE-2022-28522 · Other software · Zcms Project · reported by MITREMedium 5.4
ZCMS v20170206 was discovered to contain a stored cross-site scripting (XSS) vulnerability via index.php?m=home&c=message&a=add.
- Product
- Zcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2022ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp_set_config.CVE-2022-28521 · Other software · Zcms Project · reported by MITRECritical 9.8
ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp_set_config.
- Product
- Zcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatusCVE-2022-27165 · Other software · Cszcms · reported by MITRECritical 9.8
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Plugin_manager_setstatus
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsersCVE-2022-27164 · Other software · Cszcms · reported by MITRECritical 9.8
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_viewUsers
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUserCVE-2022-27163 · Other software · Cszcms · reported by MITRECritical 9.8
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Users_editUser
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUserCVE-2022-27162 · Other software · Cszcms · reported by MITRECritical 9.8
CSZ CMS 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_editUser
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2022Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsersCVE-2022-27161 · Other software · Cszcms · reported by MITRECritical 9.8
Csz Cms 1.2.2 is vulnerable to SQL Injection via cszcms_admin_Members_viewUsers
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php.CVE-2022-27133 · Other software · Zbzcms · reported by MITRECritical 9.1
zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php.
- Product
- Zbzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-27131 · Other software · Zbzcms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Zbzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-27129 · Other software · Zbzcms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Zbzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts.CVE-2022-27128 · Other software · Zbzcms · reported by MITRECritical 9.8
An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts.
- Product
- Zbzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.CVE-2022-27127 · Other software · Zbzcms · reported by MITREMedium 6.5
zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.
- Product
- Zbzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php.CVE-2022-27126 · Other software · Zbzcms · reported by MITRECritical 9.8
zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php.
- Product
- Zbzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2022zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php.CVE-2022-27125 · Other software · Zbzcms · reported by MITREMedium 6.1
zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php.
- Product
- Zbzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022An issue was discovered in ZZCMS 2021.CVE-2021-46437 · Other software · Zzcms · reported by MITREMedium 4.8
An issue was discovered in ZZCMS 2021. There is a cross-site scripting (XSS) vulnerability in ad_manage.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2022An issue was discovered in ZZCMS 2021.CVE-2021-46436 · Other software · Zzcms · reported by MITREHigh 7.2
An issue was discovered in ZZCMS 2021. There is a SQL injection vulnerability in ad_manage.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2022CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby paramCVE-2021-43701 · Other software · Cszcms · reported by MITREMedium 6.5
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby parameters.
- Product
- CSZ CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Mar 23, 2022ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.CVE-2022-23881 · Other software · Zzzcms · reported by MITRECritical 9.8
ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
- Product
- Zzzphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2022An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use CVE-2021-45347 · Other software · Zzcms · reported by MITREHigh 7.5
An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php.CVE-2021-45286 · Other software · Zzcms · reported by MITREMedium 5.3
Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2022There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUserCVE-2021-46377 · Other software · Cskaza · reported by MITRECritical 9.8
There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUser
- Product
- Cszcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.CVE-2021-42945 · Other software · Zzcms · reported by MITRECritical 9.8
A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2021Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php.CVE-2020-19042 · Other software · Zzcms · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2021A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.CVE-2020-19683 · Other software · Zzzcms · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.
- Product
- Zzzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzhhhy.github.iozhhhy.github.io
Dec 9, 2021A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.CVE-2020-19682 · Other software · Zzzcms · reported by MITREHigh 8.8
A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.
- Product
- Zzzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzhhhy.github.iozhhhy.github.io
Dec 9, 2021An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php.CVE-2021-43703 · Other software · Zzcms · reported by MITRECritical 9.8
An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console.
- Product
- Zzcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.