CVE-2021-47737
CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard
- State
- Published
- Severity
- 5.1 Medium
- Published
- Dec 23, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 23, 2025
Description
CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
CSZ CMSCszcms |
|
References
- ExploitDB-48357exploit
- Official CSZ CMS Vendor Homepageproduct
- CSZ CMS SourceForge Projectproduct
- VulnCheck Advisory: CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboardthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.