Zzcms

Every one of the 106 is a mark on the map. Named now: 1 to 26, most at risk first.

1. ZZCMS 2022 - Path Information DisclosureCVE-2022-40443Zzcms · CVSS 5.3 · 2.7% likely

   CWE-22

2. ZZcms - Cross-Site ScriptingCVE-2020-20285Zzcms · 1.4% likely

   CWE-79

3. zzcms 201910 contains an access control vulnerability through escalation of privileges in /user/adv.php, which allows an attacker to modify data for further attacks such as CSRF.CVE-2020-23426Zzcms · 3.7% likely

   CWE-352

4. A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters.CVE-2020-19822Zzcms · 2.8% likely

   CWE-94

5. admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal.CVE-2019-8411Zzcms · 2.7% likely

   CWE-22

6. An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leverag…CVE-2018-9331Zzcms · 2.6% likely

   CWE-22

7. An issue was discovered in zzcms 8.2. user/licence_save.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an actio…CVE-2018-8969Zzcms · 2.6% likely

   CWE-22

8. An issue was discovered in zzcms 8.2. user/manage.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg or oldflv parameter in an a…CVE-2018-8968Zzcms · 2.6% likely

   CWE-22

9. An issue was discovered in zzcms 8.2. user/ppsave.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter in an action=modi…CVE-2018-8965Zzcms · 2.6% likely

   CWE-22

10. zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80.CVE-2019-1010152zzcms · 2.4% likely

    CWE-862

11. zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.CVE-2019-1010150zzcms · 2.4% likely

    CWE-862

12. zzcms version 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: zzcms File Delete to Code Execution. The component is: user/licence_save.php.CVE-2019-1010149zzcms · 2.4% likely

    CWE-862

13. zzcms version 8.3 and earlier is affected by: SQL Injection. The impact is: zzcms File Delete to Code Execution.CVE-2019-1010148zzcms · 2.3% likely

    CWE-89

14. zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php.CVE-2018-7434Zzcms · 2.3% likely

    CWE-22

15. An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for databa…CVE-2018-16344Zzcms · 1.9% likely

    CWE-22

16. An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console.CVE-2021-43703Zzcms · 1.9% likely
17. An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dl_sendsms.php request.CVE-2018-9309Zzcms · 1.8% likely

    CWE-89

18. An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request.CVE-2018-8967Zzcms · 1.8% likely

    CWE-89

19. dl/dl_sendmail.php in zzcms 8.3 has SQL Injection via the sql parameter.CVE-2018-14961Zzcms · 1.8% likely

    CWE-89

20. An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.p…CVE-2018-8966Zzcms · 1.8% likely

    CWE-94

21. A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php.CVE-2020-19961Zzcms · 1.7% likely

    CWE-89

22. An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in controller.php.CVE-2023-42398Zzcms · 1.7% likely

    CWE-918

23. An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.CVE-2019-12348Zzcms · 1.7% likely

    CWE-89

24. Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php.CVE-2021-45286Zzcms · 1.7% likely

    CWE-22

25. zzcms 8.3 and earlier is affected by: SQL Injection. The impact is: sql inject. The component is: zs/subzs.php.CVE-2019-1010153zzcms · 1.5% likely

    CWE-89

26. An issue was discovered in zzcms 8.3. SQL Injection exists in zs/search.php via a pxzs cookie.CVE-2018-18791Zzcms · 1.5% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.