CVE-2025-13171
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
A vulnerability was identified in ZZCMS 2023 affecting the file /admin/wangkan_list.php. Manipulation of the keyword argument leads to SQL injection. The attack can be launched remotely and the exploit is publicly available.
Risk Assessment
An attacker could remotely execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The public exploit increases the risk.
Recommendation
Update ZZCMS to a patched version or implement input sanitization. Until then, restrict access to the admin panel.
Other vulnerabilities in ZZCMS
See all- CVE-2025-14837Medium
A vulnerability has been found in ZZCMS 2025 in the stripfxg function of /admin/siteconfig.php in the Backend Website Settings Module. Manipulation of the icp argument leads to code injection. The attack can be executed remotely and the exploit has been disclosed.
- CVE-2025-14836Low
A flaw in ZZCMS 2025 affects an unknown functionality in the file /reg/user_save.php of the User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation is possible. The exploit has been published.
- CVE-2023-36162High
ZZCMS versions 2023 and earlier have a Cross Site Request Forgery vulnerability that allows a remote attacker to gain privileges via the add function in adminlist.php.
- CVE-2020-23630High
A blind SQL injection vulnerability based on time exists in zzcms version 201910, exploitable through cookie manipulation. An attacker can inject malicious SQL queries via cookie parameters, leading to unauthorized database access.
Original NVD description (English source)
A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of the argument keyword leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS