CVE-2015-1442: AAS9 Zerocms

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a Modify Account action. NOTE: The article_id parameter to zero_view_article.php vector is already covered by CVE-2014-4034.

Affected products

• AAS9 Zerocms: up to and including 1.3.3; version 1.3.2 only

Published 2015-02-06. Last modified 2026-06-17.