ZrLog 安全漏洞

ZrLog is a blogging system developed in Java language by xiaochun individual developer. A security vulnerability exists in ZrLog 3.1.5 and earlier versions, which stems from cross-site scripting due to incorrect manipulation of the parameter footerLink in the file /api/admin/template/config...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

ZrLog 安全漏洞

ZrLog is a blogging system developed in Java language by xiaochun individual developer. A security vulnerability exists in ZrLog version 3.1.5, which is caused by a server-side request forgery in the downloadUrl parameter...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

CVE-2025-45872

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery SSRF via the downloadUrl parameter...

CVE-2025-45872

CVE-2025-45872 affects zrlog v3.1.5 and is described as a Server-Side Request Forgery (SSRF) in the downloadUrl parameter. The base metrics indicate a CRITICAL impact (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; 9.8) with high confidentiality, integrity, and availability implications. The conn...

CVE-2021-44093

A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell...

CVE-2020-21052

Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of the /post/addComment function...

CVE-2020-19005

zrlog v2.1.0 has a vulnerability with the permission check. If admin account is logged in, other unauthorized users can download the database backup file directly...

CVE-2020-27514

Directory Traversal vulnerability in delete function in admin.api.TemplateController in ZrLog version 2.1.15, allows remote attackers to delete arbitrary files and cause a denial of service DoS...

CVE-2020-18066

Cross Site Scripting vulnerability in ZrLog 2.1.0 via the 1 userName and 2 email parameters in post/addComment...

CVE-2019-16643

An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the articleedit area...

CVE-2018-17079

An issue was discovered in ZRLOG 2.0.1. There is a Stored XSS vulnerability in the nickname field of the comment area...

CVE-2024-57669

Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java file...

CVE-2024-57669

Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java file...

CVE-2024-57669

Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java file...

CVE-2024-57669

Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java file...

CVE-2024-57669

CVE-2024-57669 affects Zrlog backup-sql-file.jar 3.0.31. A directory traversal vulnerability could allow a remote attacker to obtain sensitive information through the BackupController.java file. The CVSSv3.1 base score is 7.5 (HIGH) with network attack vector, no user interaction, no privileges r...