What’s Vulnerable › Vulnerabilities

CVE-2019-25731: Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-04 · updated 2026-07-22
• Weakness: CWE-79

Description

Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to /gmusic/zuzconsole/___contact, which executes when administrators view messages in the inbox interface.

Affected products

• Zuz Music: 2.1

References

• https://codecanyon.net/item/zuz-music-advance-music-platform-system/21633476
• https://www.exploit-db.com/exploits/46420
• https://www.vulncheck.com/advisories/zuz-music-persistent-cross-site-scripting-via-zuzconsole-contact
• https://zuz.host/

Get alerted when CVE-2019-25731 or the next vulnerability affects your stack