QwikSec

Security Database

CVE

CWE

Training

CVE-2021-47737

Published: Dec 23, 2025

Modified: Apr 7, 2026

PUBLISHED

CVSS v3.1

5.4

MEDIUM

Description

CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks.

Vendor	Product	Versions
Cszcms	CSZ CMS	affected `1.2.7`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

ExploitDB-48357

exploit

Official CSZ CMS Vendor Homepage

product

CSZ CMS SourceForge Project

product

VulnCheck Advisory: CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.