CVE-2025-14836
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A flaw in ZZCMS 2025 affects an unknown functionality in the file /reg/user_save.php of the User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation is possible. The exploit has been published.
Risk Assessment
Risk of exposure of user data stored in cleartext, potentially leading to data confidentiality breaches.
Recommendation
It is recommended to update ZZCMS to the latest version and implement encryption for sensitive data in the database and on disk.
Other vulnerabilities in ZZCMS
See all- CVE-2025-14837Medium
A vulnerability has been found in ZZCMS 2025 in the stripfxg function of /admin/siteconfig.php in the Backend Website Settings Module. Manipulation of the icp argument leads to code injection. The attack can be executed remotely and the exploit has been disclosed.
- CVE-2023-36162High
ZZCMS versions 2023 and earlier have a Cross Site Request Forgery vulnerability that allows a remote attacker to gain privileges via the add function in adminlist.php.
- CVE-2020-23630High
A blind SQL injection vulnerability based on time exists in zzcms version 201910, exploitable through cookie manipulation. An attacker can inject malicious SQL queries via cookie parameters, leading to unauthorized database access.
Original NVD description (English source)
A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Storage Module. This manipulation causes cleartext storage in a file or on disk. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS