Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Zbzcms

First CVE: Apr 10, 2022Active for: 4 yearsTotal CVEs: 7

Zbzcms is a niche content-management system with a focused product portfolio that exhibits a strong tendency toward critical-severity vulnerabilities across its codebase. The recurring exposure centers on foundational web-application weaknesses including SQL injection, unrestricted file uploads, and cross-site scripting, which are characteristic of input-validation and file-handling gaps in less-mature CMS platforms. Current severity, exploitation activity, and exposure counts are shown alongside this summary.

FAUCET AI Generated
7
Total CVEs
More Total CVEs than 88% of tracked vendors
7.0
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 99% of tracked vendors
8.7
Avg CVSS Score
Higher Avg CVSS Score than 83% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Zbzcms over time

Volume of CVEsAvg CVSS Base Score
First CVE
Apr 10, 2022
4 years ago
Most Recent CVE
Apr 10, 2022
1,565 days ago

Products(1 total)

Top CVEs

Signals from CVEs in this vendor scope (7 CVEs).

7 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2022-27126CRITICAL
zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the art parameter at /include/make.php.
Apr 10, 20229.831NONO
CVE-2022-27131CRITICAL
An arbitrary file upload vulnerability at /zbzedit/php/zbz.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
Apr 10, 20229.830NONO
CVE-2022-27129CRITICAL
An arbitrary file upload vulnerability at /admin/ajax.php in zbzcms v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
Apr 10, 20229.830NONO
CVE-2022-27128CRITICAL
An incorrect access control issue at /admin/run_ajax.php in zbzcms v1.0 allows attackers to arbitrarily add administrator accounts.
Apr 10, 20229.830NONO
CVE-2022-27133CRITICAL
zbzcms v1.0 was discovered to contain an arbitrary file deletion vulnerability via /include/up.php.
Apr 10, 20229.128NONO
CVE-2022-27127MEDIUM
zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php.
Apr 10, 20226.522NONO
CVE-2022-27125MEDIUM
zbzcms v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the neirong parameter at /php/ajax.php.
Apr 10, 20226.121NONO
View all 7 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products7 CVEs
29%
71%
Severity distribution among all CVEs352,101 CVEs
45%
40%
11%
MediumCritical
Attack Vector
Local0 (0.0%)
Network7 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low7 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None6 (85.7%)
Unknown0 (0.0%)
Required1 (14.3%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None7 (100.0%)
Unknown0 (0.0%)

Exploit Exposure

Signals from CVEs in this vendor scope (7 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Zbzcms.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Zbzcms — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Zbzcms's Products

View all 1 CNAs →

Top CWEs