CVE-2023-36162

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Cross Site Request Forgery vulnerability in ZZCMS v.2023 and earlier allows a remote attacker to gain privileges via the add function in adminlist.php.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.zzcms.net/about/download.htmlProduct
https://github.com/779789571/zzcms/blob/main/README.md
https://github.com/forget-code/zzcms/issues/6Exploit, Issue Tracking
http://www.zzcms.net/about/download.htmlProduct
https://github.com/779789571/zzcms/blob/main/README.md
https://github.com/forget-code/zzcms/issues/6Exploit, Issue Tracking

Timeline

Published: Jul 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-361636.1Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted scrip CVE-2023-36179.8A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been classified as critical. This affects an unknown part CVE-2023-361779.8An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information CVE-2023-36186.5A flaw was found in libtiff. A specially crafted tiff file can lead to a segmentation fault due to a buffer overflow in the Fax3Encode funct CVE-2023-361837.8Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive informatio CVE-2023-361847.5CMysten Labs Sui blockchain v1.2.0 was discovered to contain a stack overflow via the component /spec/openrpc.json.CVE-2023-361879.8Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code CVE-2023-361889.8An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.CVE-2023-361897.5SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain c CVE-2023-36199.8A vulnerability was found in SourceCodester AC Repair and Services System 1.0 and classified as critical. This issue affects some unknown pr CVE-2023-361927.8Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_ws_check_packet at /src/capture.c.CVE-2023-361937.8Gifsicle v1.9.3 was discovered to contain a heap buffer overflow via the ambiguity_error component at /src/clp.c.