Login Request a demo
ZZ
Product
ZZCMS
by Zzcms · last CVE Dec 17, 2025
106
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities106In the news0Timeline
Severity mix
Critical 33High 48Medium 24Low 1
Severity
All severities106Critical33High48Medium24Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ZZCMS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-7924
7.5
1%
Aug 19
A vulnerability was found in ZZCMS 2023
Affected: 2023
CVE-2021-45347
7.5
1%
Feb 14
An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by changing the user name in the cookie to use any password
Affected: 8.2
CVE-2020-19961
7.5
2%
Oct 14
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component subzs.php
Affected: 2019
CVE-2020-19960
7.5
2%
Oct 14
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendsms.php page…
Affected: 2019
CVE-2020-19959
7.5
2%
Oct 14
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid parameter in the /dl/dl_sendmail.php page…
Affected: 2019
CVE-2020-19957
7.5
2%
Oct 14
A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parameter on the /dl/dl_print.php page
Affected: 2019
CVE-2020-21342
7.5
1%
May 13
Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php
Affected: 201910
CVE-2019-8411
7.5
3%
Feb 17
admin/dl_data.php in zzcms 2018 (2018-10-19) allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal
Affected: 2018
CVE-2018-16344
7.5
2%
Sep 2
An issue was discovered in zzcms 8.3
Affected: 8.3
CVE-2018-13056
7.5
1%
Jul 2
An issue was discovered on zzcms 8.3
Affected: 8.3
CVE-2018-9331
7.5
3%
Apr 7
An issue was discovered in zzcms 8.2
Affected: 8.2
CVE-2018-8969
7.5
3%
Mar 24
An issue was discovered in zzcms 8.2
Affected: 8.2
CVE-2018-8968
7.5
3%
Mar 24
An issue was discovered in zzcms 8.2
Affected: 8.2
CVE-2018-8966
7.5
2%
Mar 24
An issue was discovered in zzcms 8.2
Affected: 8.2
CVE-2018-8965
7.5
3%
Mar 24
An issue was discovered in zzcms 8.2
Affected: 8.2
CVE-2025-14837
7.2
0%
Dec 17
ZZCMS Backend Website Settings siteconfig.php stripfxg code injection
Affected: 2025
CVE-2024-11242
7.2
1%
Nov 15
ZZCMS Keyword Filtering ad_list.php sql injection
Affected: 2023
CVE-2022-40447
7.2
1%
Sep 22
ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojia_list.php
Affected: 2022
CVE-2022-40446
7.2
1%
Sep 22
ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=
Affected: 2022
CVE-2019-12359
7.2
1%
Jun 17
An issue was discovered in zzcms 2019
Affected: 2019
CVE-2019-12357
7.2
1%
Jun 17
An issue was discovered in zzcms 2019
Affected: 2019
CVE-2019-12354
7.2
1%
Jun 17
An issue was discovered in zzcms 2019
Affected: 2019
CVE-2019-12353
7.2
1%
Jun 17
An issue was discovered in zzcms 2019
Affected: 2019
CVE-2021-46436
7.2
1%
Apr 8
An issue was discovered in ZZCMS 2021
Affected: 2021
CVE-2021-40280
7.2
1%
Dec 9
An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php
Affected: 8.2; 8.3; 2020; 2021
CVE-2021-40279
7.2
1%
Dec 9
An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php
Affected: 8.2; 8.3; 2020; 2021
CVE-2020-19822
7.2
3%
Aug 26
A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters
Affected: 2018
CVE-2018-17416
7.2
1%
Mar 7
A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter
Affected: 8.3
CVE-2018-18790
7.2
1%
Oct 29
An issue was discovered in zzcms 8.3
Affected: 8.3
CVE-2018-18788
7.2
1%
Oct 29
An issue was discovered in zzcms 8.3
Affected: 8.3
CVE-2018-18784
7.2
1%
Oct 29
An issue was discovered in zzcms 8.3
Affected: 8.3
CVE-2018-17798
6.5
1%
Sep 30
An issue was discovered in zzcms 8.3
Affected: 8.3
CVE-2018-17797
6.5
1%
Sep 30
An issue was discovered in zzcms 8.3
Affected: 8.3
CVE-2025-1949
6.1
1%
Mar 4
ZZCMS URL register_nodb.php cross site scripting
Affected: 2025
CVE-2024-44820
6.1
0%
Sep 4
A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file located at /3/E_bak5.1/upload/
Affected: through 2023
CVE-2024-44819
6.1
0%
Sep 4
Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script to the pagename parameter of the…
Affected: through 2023
CVE-2020-19042
6.1
1%
Dec 13
Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php
Affected: 2019
CVE-2018-17413
6.1
1%
Mar 7
XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter
Affected: 8.3
CVE-2024-44818
5.4
0%
Sep 4
Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the HTTP_Referer header of the caina.php component
Affected: through 2023
CVE-2024-43006
5.4
0%
Aug 16
A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21
Affected: 2023
CVE-2022-44361
5.4
0%
Dec 7
An issue was discovered in ZZCMS 2022
Affected: 2022
CVE-2020-35973
5.4
1%
Jun 3
An issue was discovered in zzcms2020
Affected: 2020
CVE-2020-20285
5.4
1%
Dec 18
There is a XSS in the user login page in zzcms 2019
Affected: 2019
CVE-2019-9078
5.4
1%
Feb 24
zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT
Affected: 2019
CVE-2018-14962
5.4
1%
Aug 6
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php
Affected: 8.3.
CVE-2024-44821
5.3
0%
Sep 4
ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php
Affected: through 2023
CVE-2022-40444
5.3
1%
Sep 22
ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server
Affected: 2022
CVE-2022-40443
5.3
3%
Sep 22
An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php
Affected: 2022
CVE-2021-45286
5.3
2%
Feb 9
Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php
Affected: 2021
CVE-2018-7434
5.3
2%
Feb 24
zzcms 8.2 allows remote attackers to discover the full path via a direct request to 3/qq_connect2.0/API/class/ErrorCase.class.php or 3/ucenter_api/code/friend.php
Affected: 8.2
Page 2 of 3 · 106 total
123