Dzzoffice

    Dashboard / Vendors

    Products: 1
    Vulnerabilities: 14
    Known Exploited: 0
    2
    Critical Level Threats
    2
    High Level Threats
    10
    Medium Level Threats
    0
    Low Level Threats

    Vulnerabilities

    100806040200
    JanFebMarAprMayJunJulAugSepOctNovDec
    Critical Level Threats
    High Level Threats
    Medium Level Threats
    Low Level Threats

    Products Security index

    Actions
    Items Per Page

    Vulnerabilities

    CVE-2025-63694

    DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.

    Last Modified: Nov 20, 2025
    Published: Nov 18, 2025

    CVE-2025-63695

    DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.

    Last Modified: Nov 20, 2025
    Published: Nov 18, 2025

    CVE-2025-63693

    The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and execute arbitrary JavaScript code when the victim opens the editing pop-up.

    Last Modified: Nov 20, 2025
    Published: Nov 18, 2025

    CVE-2024-41376

    dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.

    Last Modified: Nov 20, 2025
    Published: Aug 05, 2024

    CVE-2024-29273

    There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.

    Last Modified: Jun 17, 2025
    Published: Mar 22, 2024
    Items Per Page
    Dzzoffice Vulnerabilities & Security CVEs | CVE-DB