CVE-2021-32605: Zzzcms Zzzphp

Critical severity, CVSS 9.8. EPSS: 3.8% chance of exploitation in the next 30 days.

zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=search URI, as demonstrated by an OS command within an "if" "end if" block.

Affected products

• Zzzcms Zzzphp: before 2.0.4 (fixed in 2.0.4)

Published 2021-05-11. Last modified 2026-06-17.