CVE-2019-7719

Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...

CVE-2018-16604

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...

CVE-2018-16604

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...

Design/Logic Flaw

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...

CVE-2018-16604

Nibbleblog v4.0.5 is affected. The issue allows an attacker with admin credentials to execute arbitrary PHP code by exploiting the username field, which is surrounded by double quotes (e.g., "${phpinfo()}"). Root cause is improper handling of the admin username leading to code execution. Impact i...

CVE-2018-16604

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes e.g., "$phpinfo"...

Nibbleblog Information Disclosure Vulnerability

Nibbleblog for macOS is a set of blogging engine based on macOS platform. A security vulnerability exists in version 4.0.5 of Nibbleblog for macOS. An attacker can exploit the vulnerability to obtain DSStore information...

CVE-2018-6470

Nibbleblog 4.0.5 on macOS defaults to having .DSStore in each directory, causing DSStore information to leak...

Design/Logic Flaw

Nibbleblog 4.0.5 on macOS defaults to having .DSStore in each directory, causing DSStore information to leak...

CVE-2018-6470

Nibbleblog 4.0.5 on macOS defaults to having .DSStore in each directory, causing DSStore information to leak...

CVE-2018-6470

Nibbleblog 4.0.5 on macOS is affected by an information disclosure vulnerability where .DS_Store files are present in each directory, leaking DS_Store metadata. Root cause is the default behavior of placing DS_Store files in directories, enabling partial confidentiality impact (DS_Store data expo...

CVE-2018-6470

Nibbleblog 4.0.5 on macOS defaults to having .DSStore in each directory, causing DSStore information to leak...

Nibbleblog File Upload Vulnerability

Exploit for php platform in category remote exploits This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contai...

Nibbleblog 4.0.3 - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contains a flaw that allows a authenticated remote attacker...

Nibbleblog File Upload

This module requires Metasploit: http://www.metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Nibbleblog File Upload Vulnerability', 'Description' = %q Nibbleblog contains a flaw that allows a authenticated remote attacker...

Nibbleblog 'index.php'存在多个跨站脚本漏洞

No description provided by source...

Nibbleblog 4.0.3 admin.php CSRF

No description provided by source. this." document.getElementById"myForm".submit;...

Nibbleblog Cross-Site Request Forgery Vulnerability

NibbleBlog is a set of blogging engines. A cross-site request forgery vulnerability exists in Nibbleblog versions prior to 4.0.3 due to an admin.php script that fails to adequately filter newsimple operations and filter the 'content' parameter in newsimple operations. A remote attacker can exploi...

Nibbleblog Arbitrary File Upload Vulnerability

NibbleBlog is a set of blogging engines. An arbitrary file upload vulnerability exists in the My Image plugin for Nibbleblog versions prior to 4.0.3. A remote attacker can exploit this vulnerability by uploading an executable file and sending a direct request to access the file to execute arbitra...

CVE-2015-6967

Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in content/private/plugins/myimage/image.php...