CVE-2025-63693

<= 2.3.7

The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-con

5.4MEDIUM

CVE-2025-63695

<= 2.3.7

DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.

9.8CRITICAL

CVE-2025-63694

<= 2.3.7

DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.

9.8CRITICAL

CVE-2024-41376

all versions

dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.

8.8HIGH

CVE-2024-29273

all versions

There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG

6.1MEDIUM

CVE-2023-39853

all versions

SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and d

6.5MEDIUM

CVE-2021-30205

all versions

Incorrect access control in the component /index.php?mod=system&op=orgtree of dzzoffice 2.02.1_SC_UTF8 allows unauthenticated atta

5.3MEDIUM

CVE-2021-30203

all versions

A reflected cross-site scripting (XSS) vulnerability in the zero parameter of dzzoffice 2.02.1_SC_UTF8 allows attackers to execute

6.1MEDIUM

CVE-2022-43340

all versions

A Cross-Site Request Forgery (CSRF) in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Adm

8.8HIGH

CVE-2021-43673

all versions

dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of the exit fun

6.1MEDIUM

CVE-2021-40292

all versions

A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter.

5.4MEDIUM

CVE-2021-40191

all versions

Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload funct

5.4MEDIUM

CVE-2020-19703

all versions

A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web sc

6.1MEDIUM

CVE-2021-3318

<= 2.02.1

attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.

6.1MEDIUM