CVEvulnerability

CVE-2021-37144

9.1 CRITICAL Published 2021-07-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-07-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
Weaknesses
CWE-706

Description

CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization.

Affected configurations

• cszcms csz cms 1.2.9

Related

Weakness · CWE (1)

  • CWE-706 Use of Incorrectly-Resolved Name or Reference weakness

References