Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
ZblogcnZ-blogphp

14 matches found

CVE
CVE•added 2018/03/06 9:29 p.m.•50 views

CVE-2018-7737

In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. NOTE: the software maintainer disputes that this is a vulnerability

5.3CVSS5.1AI score0.16126EPSS
CVE
CVE•added 2018/03/06 9:29 p.m.•49 views

CVE-2018-7736

In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability

6.1CVSS5.9AI score0.02794EPSS
CVE
CVE•added 2018/05/16 3:29 p.m.•43 views

CVE-2018-11209

An issue was discovered in Z-BlogPHP 2.0.0. zb_system/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a valid issue

7.2CVSS7AI score0.0009EPSS
CVE
CVE•added 2018/02/08 4:29 p.m.•41 views

CVE-2018-6846

Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php.

5.3CVSS5.3AI score0.00205EPSS
CVE
CVE•added 2018/03/31 10:29 p.m.•39 views

CVE-2018-8893

Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code.

8.8CVSS7.5AI score0.00141EPSS
CVE
CVE•added 2018/05/16 3:29 p.m.•38 views

CVE-2018-11208

An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NOTE: the vendor indicates that the product was not intended to block this type o...

4.8CVSS4.9AI score0.00258EPSS
CVE
CVE•added 2018/05/02 7:29 p.m.•37 views

CVE-2018-10680

Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance...

6.1CVSS5.9AI score0.0024EPSS
CVE
CVE•added 2018/10/16 7:29 a.m.•37 views

CVE-2018-18381

Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.

5.4CVSS5.2AI score0.00206EPSS
CVE
CVE•added 2018/11/22 9:29 p.m.•37 views

CVE-2018-19463

zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zb_system/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...

8.8CVSS9.1AI score0.01174EPSS
CVE
CVE•added 2018/04/16 9:58 a.m.•36 views

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The component must be accessed directly by an administrator, or through CSRF.

4.8CVSS4.9AI score0.00207EPSS
CVE
CVE•added 2018/11/26 7:29 a.m.•35 views

CVE-2018-19556

zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability

4.3CVSS4.6AI score0.0025EPSS
CVE
CVE•added 2018/10/30 6:29 a.m.•33 views

CVE-2018-18842

CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code.

8.8CVSS8.9AI score0.00221EPSS
CVE
CVE•added 2018/02/06 2:29 p.m.•30 views

CVE-2018-6656

Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.

6.5CVSS6.5AI score0.00098EPSS
CVE
CVE•added 2018/04/16 9:58 a.m.•30 views

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed direct...

7.2CVSS8.2AI score0.00682EPSS