CVE-2026-6650: Unrestricted Upload of File with Dangerous Type

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zbusers/plugin/AppCentre/appupload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available an...

Z-BlogPHP security vulnerabilities

Z-BlogPHP is an open-source PHP-based blog system developed by the Z-Blog community. Version 1.7.5 of Z-BlogPHP contains a security vulnerability. This vulnerability stems from a flaw in the App::UnPack function located in the file zbusers/plugin/AppCentre/appUpload.php of the ZBA File Handler...

CVE-2024-39203

A cross-site scripting XSS vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

EUVD-2018-20501

Malware in sbrugna...

EUVD-2018-18592

Malware in sbrugna...

EUVD-2018-10112

Malware in sbrugna...

EUVD-2018-18403

Malware in sbrugna...

EUVD-2020-21557

Malware in sbrugna...

EUVD-2020-10195

Malware in sbrugna...

EUVD-2018-20766

Malware in sbrugna...

EUVD-2020-16100

Malware in sbrugna...

EUVD-2020-21556

Malware in sbrugna...

EUVD-2018-20752

Malware in sbrugna...

EUVD-2018-10556

Malware in sbrugna...

EUVD-2022-43648

Malicious code in bioql PyPI...

EUVD-2024-52791

Malicious code in bioql PyPI...

CVE-2024-55529

Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zbusers\theme\shell\template...

CVE-2022-40357

A security issue was discovered in Z-BlogPHP = 1.7.2. A Server-Side Request Forgery SSRF vulnerability in the zbusers/plugin/UEditor/php/actioncrawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter...

CVE-2020-18268

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zbsystem/cmd.php."...

CVE-2020-23352

Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zbuser/plugin/passwordvisit/include.php:passwordvisitinputpassword uses loose comparison to authenticate, which can be bypassed via magic hash values...