PatchTheCVE: zbzcmshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2022-27133: zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php.https://patchthecve.com/cve/CVE-2022-27133.htmlhttps://patchthecve.com/cve/CVE-2022-27133.htmlWed, 17 Jun 2026 04:36:23 +0000CRITICAL 9.1: zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php.CVE-2022-27131: An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbihttps://patchthecve.com/cve/CVE-2022-27131.htmlhttps://patchthecve.com/cve/CVE-2022-27131.htmlWed, 17 Jun 2026 04:36:23 +0000CRITICAL 9.8: An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-27129: An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitraryhttps://patchthecve.com/cve/CVE-2022-27129.htmlhttps://patchthecve.com/cve/CVE-2022-27129.htmlWed, 17 Jun 2026 04:36:23 +0000CRITICAL 9.8: An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2022-27128: An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add adhttps://patchthecve.com/cve/CVE-2022-27128.htmlhttps://patchthecve.com/cve/CVE-2022-27128.htmlWed, 17 Jun 2026 04:36:23 +0000CRITICAL 9.8: An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts.CVE-2022-27127: zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.https://patchthecve.com/cve/CVE-2022-27127.htmlhttps://patchthecve.com/cve/CVE-2022-27127.htmlWed, 17 Jun 2026 04:36:23 +0000MEDIUM 6.5: zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.CVE-2022-27126: zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.phphttps://patchthecve.com/cve/CVE-2022-27126.htmlhttps://patchthecve.com/cve/CVE-2022-27126.htmlWed, 17 Jun 2026 04:36:23 +0000CRITICAL 9.8: zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php.CVE-2022-27125: zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong paramehttps://patchthecve.com/cve/CVE-2022-27125.htmlhttps://patchthecve.com/cve/CVE-2022-27125.htmlWed, 17 Jun 2026 04:36:23 +0000MEDIUM 6.1: zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php.