CVE-2021-32605

zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block.

• CWE-78

• http://www.zzzcms.com/a/news/31_282_1.htmlRelease Notes, Vendor Advisory
• https://srcincite.io/advisories/src-2021-0015/Exploit, Third Party Advisory
• http://www.zzzcms.com/a/news/31_282_1.htmlRelease Notes, Vendor Advisory
• https://srcincite.io/advisories/src-2021-0015/Exploit, Third Party Advisory

Published

May 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32598An improper neutralization of CRLF sequences in HTTP headers…4.3
• CVE-2021-32600An exposure of sensitive information to an unauthorized acto…3.8
• CVE-2021-32601Rejected reason: Not used
• CVE-2021-32602An improper neutralization of input during web page generati…6.1
• CVE-2021-32603A server-side request forgery (SSRF) (CWE-918) vulnerability…6.5
• CVE-2021-32604Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 …5.4
• CVE-2021-32606In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in…7.8
• CVE-2021-32607An issue was discovered in Smartstore (aka SmartStoreNET) th…9.8
• CVE-2021-32608An issue was discovered in Smartstore (aka SmartStoreNET) th…9.8
• CVE-2021-32609Apache Superset up to and including 1.1 does not sanitize ti…5.4
• CVE-2021-32610In Archive_Tar before 1.4.14, symlinks can refer to targets …7.1
• CVE-2021-32611A NULL pointer dereference vulnerability exists in eXcall_ap…7.5