{"vulnerability": "CVE-2024-4300", "sightings": [{"uuid": "cab29d2b-15a7-4e2d-a7bb-5e5eafe427f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-43005", "type": "seen", "source": "https://t.me/cvedetector/3371", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-43005 - ZZCMS Reflected Cross-Site Scripting (XSS)\", \n  \"Content\": \"CVE ID : CVE-2024-43005 \nPublished : Aug. 16, 2024, 8:15 p.m. | 36\u00a0minutes ago \nDescription : A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-16T22:55:28.000000Z"}, {"uuid": "67730ab3-3911-43f7-999f-055b4b946184", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-43009", "type": "seen", "source": "https://t.me/cvedetector/3369", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-43009 - ZZCMS Reflected Cross-Site Scripting (XSS) Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-43009 \nPublished : Aug. 16, 2024, 8:15 p.m. | 36\u00a0minutes ago \nDescription : A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted URL, which includes a malicious Referer header. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially resulting in session hijacking, defacement, or other malicious activities. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-16T22:55:22.000000Z"}, {"uuid": "2be09a8e-0697-4c98-8769-f5741d7da19d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-43006", "type": "seen", "source": "https://t.me/cvedetector/3367", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-43006 - ZZCMS2023 Stored XSS Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-43006 \nPublished : Aug. 16, 2024, 8:15 p.m. | 36\u00a0minutes ago \nDescription : A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sending a specially crafted POST request to /user/ask_edit.php?action=add, which includes malicious JavaScript code in the 'content' parameter. When a user visits the ask/show_{newsid}.html page, the injected script is executed in the context of the user's browser, leading to potential theft of cookies, session tokens, or other sensitive information. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"16 Aug 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-08-16T22:55:21.000000Z"}]}