Zblogcn

Records22All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

Zblogcn records in CISA KEV

No Zblogcn vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Z-blogphp 21 records HIGH Zblogphp 1 record LOW

Records

21 records in Z-blogphp · all components

TI-2022-19169 CVE-2022-40357 · GHSA-m26f-9qh4-xhx4

A security issue was discovered in Z-BlogPHP <= 1.7.2.

HIGH 82

A security issue was discovered in Z-BlogPHP <= 1.7.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01549 Published 2022-09-20 No fix listed CWE-918

TI-2024-36863 CVE-2024-55529 · GHSA-2r77-fvv3-mm9j

Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template.

MEDIUM 50

Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00622 Published 2025-01-06 No fix listed CWE-94

TI-2018-13783 CVE-2018-19463 · GHSA-87q4-fqr2-3wr2

zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to…

MEDIUM 42

zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zb_system/admin/index.php?act=UploadMng URI.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02172 Published 2018-11-22 No fix listed CWE-94

TI-2020-17594 CVE-2020-29177 · GHSA-39r8-3fqx-c3cj

Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php.

MEDIUM 41

Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00961 Published 2021-12-02 No fix listed

TI-2018-13349 CVE-2018-18842 · GHSA-p7c5-hx24-442h

CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero)…

MEDIUM 40

CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00815 Published 2018-10-30 No fix listed CWE-352

TI-2018-06432 CVE-2018-8893 · GHSA-3j9j-2r36-985r

Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code.

LOW 38

Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00449 Published 2018-03-31 No fix listed CWE-352

TI-2020-17593 CVE-2020-29176 · GHSA-qggx-95j5-5w5c

An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to…

LOW 36

An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00862 Published 2021-12-02 No fix listed CWE-434

TI-2020-14541 CVE-2020-23352 · GHSA-hcfw-jhvg-6wgg

Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control.

LOW 35

Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01087 Published 2021-01-27 No fix listed

TI-2018-05583 CVE-2018-7737 · GHSA-p6gg-7f5v-7fh8

In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by…

LOW 35

In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.08484 Published 2018-03-06 No fix listed CWE-200

TI-2018-07974 CVE-2018-11209 · GHSA-hvj4-mm2p-82f7

An issue was discovered in Z-BlogPHP 2.0.0.

LOW 34

An issue was discovered in Z-BlogPHP 2.0.0.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.00985 Published 2018-05-16 No fix listed CWE-327

TI-2018-06651 CVE-2018-9153 · GHSA-g95r-39h2-qxq6

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute…

LOW 34

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a di…

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01185 Published 2018-04-15 No fix listed CWE-434

TI-2018-05582 CVE-2018-7736 · GHSA-3qh5-grgw-6275

In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or…

LOW 33

In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.03262 Published 2018-03-06 No fix listed CWE-79

TI-2020-13361 CVE-2020-18268 · GHSA-3jrg-h4x2-422g

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive…

LOW 32

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php."

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02687 Published 2021-06-07 No fix listed CWE-601

TI-2018-07552 CVE-2018-10680 · GHSA-8xmp-wxjp-6hxw

Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an…

LOW 29

Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00864 Published 2018-05-02 No fix listed CWE-79

TI-2018-04904 CVE-2018-6656 · GHSA-gw94-wggg-3ggh

Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.

LOW 29

Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00501 Published 2018-02-06 No fix listed CWE-352

TI-2024-26206 CVE-2024-39203 · GHSA-8m6g-73m4-9jxj

A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of…

LOW 28

A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00683 Published 2024-07-08 No fix listed CWE-79

TI-2018-04997 CVE-2018-6846 · GHSA-6ww6-frcj-4qm8

Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to…

LOW 27

Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01445 Published 2018-02-08 No fix listed CWE-200

TI-2018-12998 CVE-2018-18381 · GHSA-cfx8-w95m-cq37

Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in…

LOW 25

Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00546 Published 2018-10-16 No fix listed CWE-79

TI-2018-07973 CVE-2018-11208 · GHSA-gm9r-74vm-63jm

An issue was discovered in Z-BlogPHP 2.0.0.

LOW 24

An issue was discovered in Z-BlogPHP 2.0.0.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00861 Published 2018-05-16 No fix listed CWE-79

TI-2018-06663 CVE-2018-9169 · GHSA-pf9c-4vfw-gppq

Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id…

LOW 23

Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.005 Published 2018-04-15 No fix listed CWE-79

TI-2018-13854 CVE-2018-19556 · GHSA-gv3m-w682-jc3j

zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading…

LOW 22

zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.01015 Published 2018-11-26 No fix listed CWE-20

Open these records in search →