CVE Catalog
CVE-2025-63694
CriticalSummary
DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.
Risk Assessment
Risk of unauthorized data access and potential database modification by an attacker.
Recommendation
Update to a patched version and use parameterized queries.
Other vulnerabilities in DzzOffice
See all- CVE-2025-63695Critical
DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.
- CVE-2022-43340High
A Cross-Site Request Forgery (CSRF) vulnerability in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users.
Original NVD description (English source)
DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.