CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-2016 – ZhiCms setcontroller.php index code injection
https://notcve.org/view.php?id=CVE-2024-2016
29 Feb 2024 — A vulnerability, which was classified as critical, was found in ZhiCms 4.0. Affected is the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://gist.github.com/L1nyz-tel/e3ee6f3401a9d1c580be1a9b4a8afab5 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-0603 – ZhiCms giftcontroller.php deserialization
https://notcve.org/view.php?id=CVE-2024-0603
16 Jan 2024 — A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The manipulation of the argument mylike leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://note.zhaoj.in/share/n3QsNbORUR0e • CWE-502: Deserialization of Untrusted Data •