Approved changes feed: RSS · Atom
cpe:2.3:a:dzzoffice:dzzoffice:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Dzzoffice (56edb208-c437-5a8b-b9c5-0485c06f6083) |
|---|---|
| Product | Dzzoffice (6466fe61-0237-55a5-9563-719245307362) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/zyx0814/dzzoffice |
purl2cpe | 2026-06-01 10:11:57.798819 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-63695 |
vulnerable | 2026-06-08 07:39:17.755373 |
Details available
DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.
Published: 2025-11-18T00:00:00.000Z
Updated: 2025-11-19T16:49:53.564Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63694 |
vulnerable | 2026-06-08 07:39:17.755005 |
Details available
DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.
Published: 2025-11-18T00:00:00.000Z
Updated: 2025-11-19T16:49:58.208Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63693 |
vulnerable | 2026-06-08 07:39:17.754484 |
Details available
The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and execute arbitrary JavaScript code when the victim opens the editing pop-up.
Published: 2025-11-18T00:00:00.000Z
Updated: 2025-11-19T14:41:00.438Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29273 |
vulnerable | 2026-06-08 06:33:29.083026 |
Details available
There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.
Published: 2024-03-22T00:00:00.000Z
Updated: 2024-08-27T20:38:27.323Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-3318 |
vulnerable | 2026-06-08 05:33:51.164626 |
Details available
attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.
Published: 2021-01-27T17:13:04.000Z
Updated: 2024-08-03T16:53:17.417Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.