PatchTheCVEzzzphp vulnerabilities and fixes
Recent CVEs affecting zzzphp, with upgrade or downgrade steps. 14 tracked.
zzzphp has 14 tracked vulnerabilities, 8 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 3. Most recent: 2023-10-18. Highest priority: CVE-2019-9082 (score 86/100).
- CVE-2023-45909 MEDIUM 6.1 DOWNGRADE zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.
- CVE-2022-23881 CRITICAL 9.8 DOWNGRADE ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key()
- CVE-2021-32605 CRITICAL 9.8 UPGRADE zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the key
- CVE-2020-24877 CRITICAL 9.8 DOWNGRADE A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible a
- CVE-2020-20298 CRITICAL 9.8 DOWNGRADE Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzz
- CVE-2020-18717 CRITICAL 9.8 DOWNGRADE SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parame
- CVE-2019-9182 HIGH 8.8 DOWNGRADE There is a CSRF in ZZZCMS zzzphp V1.6.1 via a /admin015/save.php?act=editfile request
- CVE-2019-9082 HIGH 8.8 EXPLOITED UPGRADE DOWNGRADE ThinkPHP Remote Code Execution Vulnerability
- CVE-2019-9041 HIGH 7.2 DOWNGRADE An issue was discovered in ZZZCMS zzzphp V1.6.1
- CVE-2019-17408 CRITICAL 9.8 DOWNGRADE parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code
- CVE-2019-16722 CRITICAL 9.8 DOWNGRADE ZZZCMS zzzphp v1.7.2 has an insufficient protection mechanism against PHP Code Execution, because passthru byp
- CVE-2019-16720 HIGH 7.5 DOWNGRADE ZZZCMS zzzphp v1.7.2 does not properly restrict file upload in plugins/ueditor/php/controller.php?upfolder=new
- CVE-2019-10647 CRITICAL 9.8 DOWNGRADE ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/uedit
- CVE-2018-20127 HIGH 7.5 DOWNGRADE An issue was discovered in zzzphp cms 1.5.8
FAQ
How do I fix zzzphp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is zzzphp being exploited right now?
Yes: 1 zzzphp CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which zzzphp CVE should I patch first?
CVE-2019-9082 currently ranks highest (86/100): ThinkPHP Remote Code Execution Vulnerability.