PatchTheCVEzbzcms vulnerabilities and fixes
Recent CVEs affecting zbzcms, with upgrade or downgrade steps. 7 tracked.
zbzcms has 7 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-04-10. Highest priority: CVE-2022-27131 (score 58/100).
- CVE-2022-27133 CRITICAL 9.1 DOWNGRADE zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php.
- CVE-2022-27131 CRITICAL 9.8 DOWNGRADE An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbi
- CVE-2022-27129 CRITICAL 9.8 DOWNGRADE An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary
- CVE-2022-27128 CRITICAL 9.8 DOWNGRADE An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add ad
- CVE-2022-27127 MEDIUM 6.5 DOWNGRADE zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.
- CVE-2022-27126 CRITICAL 9.8 DOWNGRADE zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php
- CVE-2022-27125 MEDIUM 6.1 DOWNGRADE zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parame
FAQ
How do I fix zbzcms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zbzcms being exploited right now?
None of the tracked zbzcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which zbzcms CVE should I patch first?
CVE-2022-27131 currently ranks highest (58/100): An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbi.