Show filters
21 Total Results
Displaying 1-10 of 21
Sort by:
Attacker Value
Unknown
CVE-2024-39203
Disclosure Date: July 08, 2024 (last updated July 10, 2024)
A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
0
Attacker Value
Unknown
CVE-2020-23327
Disclosure Date: April 04, 2023 (last updated October 08, 2023)
Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter of the module management model.
0
Attacker Value
Unknown
CVE-2022-40357
Disclosure Date: September 20, 2022 (last updated October 08, 2023)
A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter.
0
Attacker Value
Unknown
CVE-2020-29177
Disclosure Date: December 02, 2021 (last updated February 23, 2025)
Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php.
0
Attacker Value
Unknown
CVE-2020-29176
Disclosure Date: December 02, 2021 (last updated February 23, 2025)
An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file.
0
Attacker Value
Unknown
CVE-2020-18268
Disclosure Date: June 07, 2021 (last updated February 22, 2025)
Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php."
0
Attacker Value
Unknown
CVE-2020-23352
Disclosure Date: January 27, 2021 (last updated February 22, 2025)
Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zb_user/plugin/passwordvisit/include.php:passwordvisit_input_password() uses loose comparison to authenticate, which can be bypassed via magic hash values.
0
Attacker Value
Unknown
CVE-2018-19556
Disclosure Date: November 26, 2018 (last updated November 08, 2023)
zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability
0
Attacker Value
Unknown
CVE-2018-19463
Disclosure Date: November 22, 2018 (last updated November 08, 2023)
zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zb_system/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP by uploading an image in current version." It also requires authentication
0
Attacker Value
Unknown
CVE-2018-18842
Disclosure Date: October 30, 2018 (last updated November 27, 2024)
CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code.
0
