z-blogphp vulnerabilities and exploits

(subscribe to this query)

6.5

CVSSv2

The plugin upload component in Z-BlogPHP 1.5.1 allows remote malicious users to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The componen...

Zblogcn Z-blogphp 1.5.1

3.5

CVSSv2

Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The component must be accessed directly by an administrator, or through CSRF.

Zblogcn Z-blogphp 1.5.1

3.5

CVSSv2

An issue exists in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote malicious users to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NOTE: the vendor indicates that the product was not in...

Zblogcn Z-blogphp 2.0.0

4.3

CVSSv2

Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor di...

Zblogcn Z-blogphp 1.5.2

3.5

CVSSv2

Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.

Zblogcn Z-blogphp 1.5.2.1935

4.3

CVSSv2

In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability

Zblogcn Z-blogphp 1.5.1.1740

1 EDB exploit

5

CVSSv2

In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. NOTE: the software maintainer disputes that this is a vulnerability

Zblogcn Z-blogphp 1.5.1.1740

1 EDB exploit

4

CVSSv2

An issue exists in Z-BlogPHP 2.0.0. zb_system/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for malicious users to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a...

Zblogcn Z-blogphp 2.0.0

6.8

CVSSv2

CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote malicious users to execute arbitrary PHP code.

Zblogcn Z-blogphp 1.5.2.1935\\(zero\\)

Get Started

« PREV 1 2

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook