Critical severity · published Dec 9, 2021
CVE-2021-43703
An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php
9.8
CVSS
1.9%
EPSS
No
On KEV
Description
An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZZ
Zzcms · Zzcms
through 2019 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-43703
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-43703
Exploit
https://github.com/forget-code/zzcms/issues/1
More from Zzcms
9.8
CVE-2025-22957
A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited without any authentication
9.8
CVE-2025-0565
ZZCMS index.php sql injection
9.8
CVE-2024-52724
ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php
9.8
CVE-2024-10293
ZZCMS functions.php Ebak_SetGotoPak unrestricted upload
9.8
CVE-2024-10292
ZZCMS ChangeTable.php unrestricted upload