Product Referenceproduct
https://codecanyon.net/item/zuz-music-advance-music-platform-system/21633476 CVE-2019-25731
MEDIUM
Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact
Record summary
CVE-2019-25731 has a selected CVSS score of 5.3 (medium); EIP currently links 1 catalogued exploit.
Description
Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript by submitting crafted contact form data. Attackers can inject script code through the name, subject, and message parameters in POST requests to /gmusic/zuzconsole/___contact, which executes when administrators view messages in the inbox interface.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 4, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Zuz MusicBrowse Zuz / Zuz Music | CVE List | 2.1 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBZuz Music 2.1 - 'zuzconsole/___contact ' Persistent Cross-Site ScriptingExploitDB exploitby Deyaa MuhammadNot analyzed1 file
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-25731 ExploitDB-46420exploit
https://www.exploit-db.com/exploits/46420 VulnCheck Advisory: Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole ContactThird-party advisory
https://www.vulncheck.com/advisories/zuz-music-persistent-cross-site-scripting-via-zuzconsole-contact Official Product Homepageproduct
https://zuz.host/