Vulnerability · Published Dec 23, 2025 · Assigned by VulnCheck
CVE-2021-47737CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard
Medium 5.4
In plain English
A medium-severity cross-site scripting in CSZ CMS from Cszcms. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 79.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- ExploitDB-48357 exploit
- Official CSZ CMS Vendor Homepage product
- CSZ CMS SourceForge Project product
- VulnCheck Advisory: CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard third-party-advisory