Risk Letters

Exploited vulnerability

CVE-2019-9041

TLP:CLEAR

zzzcms zzzphp Improper Neutralization of Special Elements used in an Expression Language Statement

An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring.

Facts

  • Vendor: zzzcms
  • Product: zzzphp
  • EPSS (probability of exploitation within 30 days): 31.4 %
  • First known exploitation: 29 October 2026
  • First seen by Risk Letters: 29 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD