Zippy vulnerabilities

Products

• Zstore 2

Latest Zippy CVEs

Newest publication first

1. CVE-2023-53985 Zstore 6.5.4 - Reflected Cross-Site Scripting (XSS)

   Published 2026-01-13

   Medium·CVSS 5.1 EPSS 0.29%

   Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through unvalidated input parameters. Attackers can submit crafted payloads in manual insertion points to execute arbitrary JavaSc...

2. CVE-2023-24648 Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php.

   Published 2023-02-13

   Medium·CVSS 6.1 EPSS 0.47%

   Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.