PT-2021-11656

Name of the Vulnerable Software and Affected Versions: Z-BlogPHP version 1.6.1.2100 Description: The issue allows for arbitrary file deletion via the app del.php endpoint. Recommendations: For Z-BlogPHP version 1.6.1.2100, as a temporary workaround, consider restricting access to the app del.php...

The vulnerability of the cmd.php component in the Z-BlogPHP blogging software allows a hacker to redirect users to arbitrary websites and carry out phishing attacks using a specially crafted URL.

The vulnerability of the cmd.php component in the Z-BlogPHP blog software relates to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to redirect users to arbitrary websites and carry out phishing attacks using specially crafted URLs...

Z-BlogPHP Information Disclosure Vulnerability (CNVD-2021-43494)

Z-BlogPHP is an open source PHP-based blogging system for the Z-blog community. An information disclosure vulnerability exists in Z-BlogPHP, which stems from a configuration error in Open Redirect in Z-BlogPHP v1.5.2 and earlier versions. The vulnerability can be exploited to obtain sensitive...

CVE-2020-18268

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zbsystem/cmd.php."...

CVE-2020-18268

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zbsystem/cmd.php."...

Open redirect

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zbsystem/cmd.php."...

CVE-2020-18268

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zbsystem/cmd.php."...

CVE-2020-18268

CVE-2020-18268 : Z-BlogPHP

CVE-2020-18268

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zbsystem/cmd.php."...

PT-2021-3464

Name of the Vulnerable Software and Affected Versions Z-BlogPHP versions 1.5.2 and earlier Description The issue allows remote attackers to obtain sensitive information via the redirect parameter in the zb system/cmd.php component. This can enable an attacker to redirect users to arbitrary...

Z-BlogPHP 输入验证错误漏洞

Z-BlogPHP is an open source PHP-based blogging system for the Z-blog community. An information disclosure vulnerability exists in Z-BlogPHP, which stems from a configuration error in Open Redirect in Z-BlogPHP v1.5.2 and earlier versions. The vulnerability can be exploited to obtain sensitive...

CVE-2020-18268: URL Redirection to Untrusted Site

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zbsystem/cmd.php."...

Z-BlogPHP Authentication Bypass Vulnerability

Z-BlogPHP is an open source PHP-based blogging system for the Z-blog community. A security vulnerability exists in Z-BlogPHP version 1.6.0, which stems from the passwordvisitinputpassword function in zbuser/plugin/passwordvisit/include.php that uses loose comparisons for authentication, which...

CVE-2020-23352

Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zbuser/plugin/passwordvisit/include.php:passwordvisitinputpassword uses loose comparison to authenticate, which can be bypassed via magic hash values...

CVE-2020-23352

Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zbuser/plugin/passwordvisit/include.php:passwordvisitinputpassword uses loose comparison to authenticate, which can be bypassed via magic hash values...

Authentication flaw

Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zbuser/plugin/passwordvisit/include.php:passwordvisitinputpassword uses loose comparison to authenticate, which can be bypassed via magic hash values...

CVE-2020-23352

Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zbuser/plugin/passwordvisit/include.php:passwordvisitinputpassword uses loose comparison to authenticate, which can be bypassed via magic hash values...

CVE-2020-23352

Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zbuser/plugin/passwordvisit/include.php:passwordvisitinputpassword uses loose comparison to authenticate, which can be bypassed via magic hash values...

CVE-2020-23352

CVE-2020-23352 affects Z-BlogPHP 1.6.0 Valyria. The vulnerability lies in zb_user/plugin/passwordvisit/include.php:passwordvisit_input_password(), which uses loose comparisons for authentication, allowing bypass via magic hash values and resulting in an authentication bypass (no information discl...

PT-2021-10884

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.6.0 Valyria Description The issue is related to incorrect access control in Z-BlogPHP. It is possible to bypass authentication using PHP loose comparison and a magic hash. The passwordvisit input password function in zb...