Vulnerabilities

TI-2021-08820 CVE-2021-27280 · GHSA-wmhj-jq93-j3p7

OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary…

HIGH 69

OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00973 Published 2023-05-08 No fix listed CWE-434

TI-2021-21008 CVE-2021-46028 · GHSA-57jj-772p-fq8q

LOW 20

In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00355 Published 2022-01-19 No fix listed CWE-352

TI-2020-13657 CVE-2020-19619 · GHSA-8wjm-43hp-cvp5

LOW 25

Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00637 Published 2021-04-01 No fix listed CWE-79

TI-2020-13656 CVE-2020-19618 · GHSA-8f2w-rxmp-q2x5

LOW 25

Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00637 Published 2021-04-01 No fix listed CWE-79

TI-2020-13655 CVE-2020-19617 · GHSA-ffg8-5m28-xmv3

LOW 25

Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00603 Published 2021-04-01 No fix listed CWE-79

TI-2020-13654 CVE-2020-19616 · GHSA-f6hm-f4f7-xqgv

LOW 25

Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00603 Published 2021-04-01 No fix listed CWE-79