256 matches found
CVE-2018-7736
Z-BlogPHP 1.5.1.1740 has an XSS issue in cmd.php exploitable via ZC_BLOG_SUBNAME or ZC_UPLOAD_FILETYPE (observed payloads demonstrate client-side script injection). The CVE entry notes the maintainer disputes this as a vulnerability. Connected sources (Exploit-DB, 1337DAY, PacketStorm) describe w...
CVE-2018-7737
Z-BlogPHP 1.5.1.1740 has a reported Web Site physical path leakage vulnerability. The issue is described as path disclosure affecting admin/footer and related admin files, with the maintainer disputing it as a vulnerability. Public PoCs/Exploits exist (e.g., Exploit-DB, PacketStorm, Exploit packs...
CVE-2018-7736
In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZCBLOGSUBNAME parameter or ZCUPLOADFILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability...
CVE-2018-7736: Improper Neutralization of Input During Web Page Generation
In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZCBLOGSUBNAME parameter or ZCUPLOADFILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability...
CVE-2018-7737: Exposure of Sensitive Information to an Unauthorized Actor
In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by adminfooter.php or adminfooter.php. NOTE: the software maintainer disputes that this is a vulnerability...
PT-2018-18248 · Z Blogphp · Z-Blogphp
Name of the Vulnerable Software and Affected Versions: Z-BlogPHP version 1.5.1.1740 Description: There is a potential issue in Z-BlogPHP where the physical path of the web site may be leaked, as demonstrated by accessing certain files such as admin footer.php. However, it's noted that the softwar...
CVE-2018-6846
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...
Path traversal
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...
CVE-2018-6846
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...
CVE-2018-6846
CVE-2018-6846 affects Z-BlogPHP 1.5.1 and enables remote attackers to disclose the full server path by directly requesting zb_system/function/lib/upload.php. Multiple sources (Red Hat, NVD, CNVD, CVE entries) confirm an information-disclosure path-traversal style exposure without wider exploitati...
CVE-2018-6846
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...
CVE-2018-6846: Exposure of Sensitive Information to an Unauthorized Actor
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...
Z-BlogPHP Cross-Site Request Forgery Vulnerability
Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A cross-site request forgery vulnerability exists in Z-BlogPHP version 1.5.1. A remote attacker can exploit this vulnerability to delete the users directory and files with the help of the...
Cross site request forgery (csrf)
Z-BlogPHP 1.5.1 has CSRF via zbusers/plugin/AppCentre/appdel.php, as demonstrated by deleting files and directories...
CVE-2018-6656
Z-BlogPHP 1.5.1 has CSRF via zbusers/plugin/AppCentre/appdel.php, as demonstrated by deleting files and directories...
CVE-2018-6656
Z-BlogPHP 1.5.1 has CSRF via zbusers/plugin/AppCentre/appdel.php, as demonstrated by deleting files and directories...
CVE-2018-6656
Summary: CVE-2018-6656 affects Z-BlogPHP 1.5.1 with a cross‑site request forgery (CSRF) vulnerability in zb_users/plugin/AppCentre/app_del.php. The vulnerability enables a remote attacker to trigger actions that delete files and directories under the user area, as described in CNVD-2018-05361 and...
CVE-2018-6656
Z-BlogPHP 1.5.1 has CSRF via zbusers/plugin/AppCentre/appdel.php, as demonstrated by deleting files and directories...
