Search
Total
10 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-18268 | 1 Zblogcn | 1 Z-blogphp | 2021-06-15 | 5.8 MEDIUM | 6.1 MEDIUM |
| Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." | |||||
| CVE-2018-18381 | 1 Zblogcn | 1 Z-blogphp | 2019-09-23 | 3.5 LOW | 5.4 MEDIUM |
| Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments. | |||||
| CVE-2018-10680 | 1 Zblogcn | 1 Z-blogphp | 2019-04-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| ** DISPUTED ** Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug." | |||||
| CVE-2018-19556 | 1 Zblogcn | 1 Z-blogphp | 2019-04-16 | 4.3 MEDIUM | 4.3 MEDIUM |
| ** DISPUTED ** zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability. | |||||
| CVE-2018-7736 | 1 Zblogcn | 1 Z-blogphp | 2019-04-16 | 4.3 MEDIUM | 6.1 MEDIUM |
| ** DISPUTED ** In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability. | |||||
| CVE-2018-7737 | 1 Zblogcn | 1 Z-blogphp | 2019-04-16 | 5.0 MEDIUM | 5.3 MEDIUM |
| ** DISPUTED ** In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. NOTE: the software maintainer disputes that this is a vulnerability. | |||||
| CVE-2018-11208 | 1 Zblogcn | 1 Z-blogphp | 2019-04-16 | 3.5 LOW | 4.8 MEDIUM |
| ** DISPUTED ** An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NOTE: the vendor indicates that the product was not intended to block this type of XSS by a user with the admin privilege. | |||||
| CVE-2018-9169 | 1 Zblogcn | 1 Z-blogphp | 2018-05-18 | 3.5 LOW | 4.8 MEDIUM |
| Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The component must be accessed directly by an administrator, or through CSRF. | |||||
| CVE-2018-6656 | 1 Zblogcn | 1 Z-blogphp | 2018-03-13 | 5.8 MEDIUM | 6.5 MEDIUM |
| Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories. | |||||
| CVE-2018-6846 | 1 Zblogcn | 1 Z-blogphp | 2018-03-08 | 5.0 MEDIUM | 5.3 MEDIUM |
| Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php. | |||||