PT-2018-18902

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.5.1 Description The issue allows for XSS via the app id parameter in the zb users/plugin/AppCentre/plugin edit.php endpoint. This requires direct access by an administrator or can be exploited through CSRF. Recommendations...

PT-2018-18890

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.5.1 Description The issue allows remote attackers to execute arbitrary PHP code via the app id parameter to "zb users/plugin/AppCentre/plugin edit.php" due to an unanchored regular expression. This can be exploited by...