PT-2025-52837 · Csz Cms · Csz Cms

Published 2025-12-23 · Updated 2025-12-23 · CVE-2021-47737

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.2.7

Description An HTML injection issue exists in CSZ CMS that permits authenticated users to inject malicious hyperlinks into message titles. Attackers can create POST requests to the member messaging system using HTML-based links, potentially enabling phishing or social engineering attacks. The vulnerability affects the member messaging system. The vulnerable parameter is the message title.

Recommendations Apply updates to address the HTML injection issue in message titles.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-47737

Affected Products

Csz Cms

References · 7

• 🔥 https://exploit-db.com/exploits/48357 · Exploit
• https://osv.dev/vulnerability/CVE-2021-47737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47737 · Security Note
• https://cszcms.com · Note
• https://sourceforge.net/projects/cszcms · Note
• https://vulncheck.com/advisories/csz-cms-html-injection-vulnerability-via-member-dashboard · Note
• https://twitter.com/CVEnew/status/2003567278122484183 · Twitter Post