CVE-2023-36162

HighCVSS 8.8

Published: 03/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

ZZCMS versions 2023 and earlier have a Cross Site Request Forgery vulnerability that allows a remote attacker to gain privileges via the add function in adminlist.php.

Risk Assessment

An attacker can exploit this vulnerability to gain unauthorized access to administrative functions, potentially leading to serious security breaches.

Recommendation

It is recommended to update ZZCMS to the latest version and implement protections against CSRF attacks.

Other vulnerabilities in ZZCMS

CVE-2020-23630High
A blind SQL injection vulnerability based on time exists in zzcms version 201910, exploitable through cookie manipulation. An attacker can inject malicious SQL queries via cookie parameters, leading to unauthorized database access.

Original NVD description (English source)

Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS