CVE-2019-9078

Impact

zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-case string such as sCrIpT.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/NS-Sp4ce/ZZCMS-XSS/blob/master/xss.md
• https://github.com/NS-Sp4ce/ZZCMS-XSS/blob/master/xss.md