CVE-2017-17792

BlogoText (CMS) contains a Cross-site scripting (XSS) flaw in the markup_clean_href function, inc/conv.php, up to version 3.7.6. The root cause is improper handling in markup_clean_href that allows remote attackers to inject arbitrary JavaScript via a comment, as described in multiple sources (NV...

BlogoText 'creer_fichier_zip' function information disclosure vulnerability

BlogoText is a lightweight SQLite blogging engine. An information disclosure vulnerability exists in the 'creerfichierzip' function in the admin/maintenance.php file in BlogoText 3.7.6 and earlier versions. A remote attacker can exploit this vulnerability by providing the name archiv1.zip to brea...

BlogoText 'markup_clean_href' function cross-site scripting vulnerability

BlogoText is a lightweight SQLite blogging engine. A cross-site scripting vulnerability exists in the 'markupcleanhref' function in the inc/conv.php file in BlogoText 3.7.6 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary JavaScript code with the help of ...

BlogoText 'validate_form_preferences' function access restriction bypass vulnerability

BlogoText is a lightweight SQLite blogging engine. An access restriction bypass vulnerability exists in the 'validateformpreferences' function in the admin/preferences.php file in BlogoText 3.7.6 and earlier versions. An attacker can exploit this vulnerability to bypass access restrictions...

Cross site scripting

Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can for example change global settings or create/delete posts. It is also possible to execute JavaScript against...

CVE-2017-14957

Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can for example change global settings or create/delete posts. It is also possible to execute JavaScript against...

CVE-2017-14957

Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator, an attacker can for example change global settings or create/delete posts. It is also possible to execute JavaScript against...

CVE-2017-14957

CVE-2017-14957 is a stored XSS vulnerability in BlogoText prior to 3.7.6. The attack path is through a comment in inc/conv.php, allowing an unauthenticated attacker to inject JavaScript. If the victim is an administrator, the attacker can alter global settings or create/delete posts; it can also ...