Cszcms vulnerabilities
Published CVEs affecting Cszcms products: 4 record(s), with severity, exploitation and fixes.
CVE-2021-47738
Medium · 5.4
CWE-79 Dec 23, 2025
CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging
CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend dashboard.
CVE-2021-47737
Medium · 5.4
CWE-79 Dec 23, 2025
CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard
CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks.
CVE-2024-58307
High · 8.8
CWE-89 Dec 11, 2025
CSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint
CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries. Attackers can inject malicious SQL code through the view parameter to potentially execute time-based blind SQL injection attacks and extract database information.
CVE-2025-63608
Medium · 5.4
CWE-89 Oct 30, 2025
SQL Injection in Cszcms Csz Cms
A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form viewing feature, allowing authenticated administrators to execute arbitrary SQL queries.