GCVE - cpe:2.3:a:cszcms:csz_cms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cszcms:csz_cms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Cszcms (`8ad51d47-ebd1-57b7-9393-48e43805ff6d`)
Product	Csz Cms (`84ba435b-7100-507c-97dd-1a0439326813`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/cskaza/cszcms`	purl2cpe	2026-06-01 10:16:10.882419

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-63608`	vulnerable	2026-06-08 07:39:17.682631	Details available A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is located in the field parameter of the form viewing feature, allowing authenticated administrators to execute arbitrary SQL queries. Published: 2025-10-30T00:00:00.000Z Updated: 2025-11-24T20:29:13.478Z Open on db.gcve.eu Reference links https://github.com/Huu1j/CSZ_CMS-exploit/blob/main/csz-cms-vulnerability-analysis.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-27752`	vulnerable	2026-06-08 06:31:29.148453	Details available Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the Default Keyword field in the settings function. Published: 2024-04-19T00:00:00.000Z Updated: 2024-08-02T00:34:52.523Z Open on db.gcve.eu Reference links https://github.com/flyhha/cms/blob/main/1.md	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-47738`	vulnerable	2026-06-08 05:38:07.535113	CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging MEDIUM (5.4) CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend dashboard. Published: 2025-12-23T19:34:10.399Z Updated: 2026-04-07T14:05:52.492Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48354 https://www.cszcms.com/ https://sourceforge.net/projects/cszcms/ https://www.vulncheck.com/advisories/csz-cms-persistent-cross-site-scripting-via-private-messaging	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-47737`	vulnerable	2026-06-08 05:38:07.533830	CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard MEDIUM (5.4) CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks. Published: 2025-12-23T19:35:47.888Z Updated: 2026-04-07T14:05:51.762Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/48357 https://www.cszcms.com/ https://sourceforge.net/projects/cszcms/ https://www.vulncheck.com/advisories/csz-cms-html-injection-vulnerability-via-member-dashboard	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-13086`	vulnerable	2026-06-08 05:12:40.876284	Details available core/MY_Security.php in CSZ CMS 1.2.2 before 2019-06-20 has member/login/check SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf_csz parameter. Published: 2019-06-30T16:16:02.000Z Updated: 2024-08-04T23:41:10.401Z Open on db.gcve.eu Reference links https://github.com/cskaza/cszcms/issues/19	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.