What’s Vulnerable › Vulnerabilities

CVE-2021-47737: CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-23 · updated 2026-06-17
• Weakness: CWE-79

Description

CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks.

Affected products

• Cszcms CSZ CMS: 1.2.7

References

• https://sourceforge.net/projects/cszcms/
• https://www.cszcms.com/
• https://www.exploit-db.com/exploits/48357
• https://www.vulncheck.com/advisories/csz-cms-html-injection-vulnerability-via-member-dashboard

Get alerted when CVE-2021-47737 or the next vulnerability affects your stack