Vulnerabilities

TI-2022-07679 CVE-2022-23626

Insufficient file checks in m1k1o/blog

HIGH 73

m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.09874 Published 2022-02-08 Fixed in 1.4 CWE-20

TI-2017-10463 CVE-2017-14346 · GHSA-8pcm-hgjf-6vp8

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP…

MEDIUM 46

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02096 Published 2017-09-12 No fix listed CWE-434

TI-2017-10462 CVE-2017-14345 · GHSA-5pqg-75fv-gp23

SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.

MEDIUM 44

SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01097 Published 2017-09-12 No fix listed CWE-89

Vulnerabilities

Filters

Insufficient file checks in m1k1o/blog

upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP…

SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.