Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-47738: CSZ CMS 1.2.7: Malicious JavaScript in Private Messages Can Harm Admins

CVE-2021-47738 · published 10 months ago

Summary

CSZ CMS version 1.2.7 has a security flaw that lets attackers send malicious code to admins through private messages. This code can harm the website and its users if admins unknowingly execute it. To protect your site, update to the latest version of CSZ CMS or apply a patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
cszcms	csz_cms	1.2.7 `cpe:2.3:a:cszcms:csz_cms:1.2.7:::::::*`

Original advisory text

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend dashboard.

References

https://sourceforge.net/projects/cszcms/ Product
https://www.cszcms.com/ Product
https://www.exploit-db.com/exploits/48354 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/csz-cms-persistent-cross-site-scripting-via... Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published23 Dec 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2021-47738 · NVD

Track software like this

Free during beta