zzcms vulnerabilities and fixes

Recent CVEs affecting zzcms, with upgrade or downgrade steps. 26 tracked.

zzcms has 26 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 9. Most recent: 2025-12-18. Highest priority: CVE-2025-22957 (score 56/100).

• CVE-2025-13171 MEDIUM 6.3 DOWNGRADE A vulnerability was identified in ZZCMS 2023
• CVE-2025-14837 MEDIUM 4.7 DOWNGRADE A vulnerability has been found in ZZCMS 2025
• CVE-2025-14836 LOW 2.7 DOWNGRADE A flaw has been found in ZZCMS 2025
• CVE-2025-22957 CRITICAL 9.8 UPGRADE A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited
• CVE-2025-1949 MEDIUM 4.3 DOWNGRADE A vulnerability, which was classified as problematic, has been found in ZZCMS 2025
• CVE-2025-0565 HIGH 7.3 DOWNGRADE A vulnerability was found in ZZCMS 2023
• CVE-2024-7927 HIGH 7.3 DOWNGRADE A vulnerability classified as critical was found in ZZCMS 2023
• CVE-2024-7926 HIGH 7.3 DOWNGRADE A vulnerability classified as critical has been found in ZZCMS 2023
• CVE-2024-7925 MEDIUM 4.3 DOWNGRADE A vulnerability was found in ZZCMS 2023
• CVE-2024-7924 MEDIUM 5.3 DOWNGRADE A vulnerability was found in ZZCMS 2023
• CVE-2024-52724 CRITICAL 9.8 DOWNGRADE ZZCMS 2023 was discovered to contain a SQL injection vulnerability in /q/show.php.
• CVE-2024-44821 MEDIUM 5.3 UPGRADE ZZCMS 2023 contains a vulnerability in the captcha reuse logic located in /inc/function.php
• CVE-2024-44820 MEDIUM 6.1 UPGRADE A sensitive information disclosure vulnerability exists in ZZCMS v.2023 and before within the eginfo.php file
• CVE-2024-44819 MEDIUM 6.1 UPGRADE Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive inf
• CVE-2024-44818 MEDIUM 5.4 UPGRADE Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive inf
• CVE-2024-44817 HIGH 8.8 UPGRADE SQL Injection vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive informatio
• CVE-2024-43011 MEDIUM 4.9 UPGRADE An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier
• CVE-2024-43009 MEDIUM 4.7 UPGRADE A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and ear
• CVE-2024-43006 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21
• CVE-2024-43005 MEDIUM 4.7 DOWNGRADE A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows
• CVE-2024-11242 MEDIUM 4.7 DOWNGRADE A vulnerability was found in ZZCMS 2023
• CVE-2024-11130 LOW 2.4 UPGRADE A vulnerability was found in ZZCMS up to 2023
• CVE-2024-10293 MEDIUM 6.3 DOWNGRADE A vulnerability was found in ZZCMS 2023
• CVE-2024-10292 MEDIUM 6.3 DOWNGRADE A vulnerability was found in ZZCMS 2023 and classified as critical
• CVE-2024-10291 MEDIUM 6.3 DOWNGRADE A vulnerability has been found in ZZCMS 2023 and classified as critical
• CVE-2024-10290 MEDIUM 5.3 DOWNGRADE A vulnerability, which was classified as problematic, was found in ZZCMS 2023

FAQ

How do I fix zzcms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is zzcms being exploited right now?

None of the tracked zzcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which zzcms CVE should I patch first?

CVE-2025-22957 currently ranks highest (56/100): A SQL injection vulnerability exists in the front-end of the website in ZZCMS <= 2023, which can be exploited .

RSS feed for zzcms · ← Back to latest CVEs