CVE-2025-14837
ZZCMS Backend Website Settings siteconfig.php stripfxg code injection
- State
- Published
- Severity
- 5.1 Medium
- Published
- Dec 17, 2025
- Updated
- Feb 24, 2026
- Reserved
- Dec 17, 2025
Description
A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Website Settings Module. Such manipulation of the argument icp leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.7 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 4.7 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.8 Medium | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ZZCMSn/a |
|
References
- VDB-336987 | ZZCMS Backend Website Settings siteconfig.php stripfxg code injectionvdb-entrytechnical-description
- VDB-336987 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #711655 | zzcms zzcms2025 Command Injectionthird-party-advisory
- https://note-hxlab.wetolink.com/share/ekNgcv2wVByaexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.