Vulnerabilities

TI-2023-30171 CVE-2023-53888 · GHSA-9g2h-fh68-3p2v

Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation

HIGH 72

Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00959 Published 2025-12-15 No fix listed CWE-94

TI-2023-30170 CVE-2023-53887 · GHSA-47f7-v3jr-88mg

Zomplog 3.9 Cross-Site Scripting Vulnerability via Page Creation

MEDIUM 56

Zomplog 3.9 contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts when creating new pages.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00245 Published 2025-12-15 No fix listed CWE-79

TI-2008-02253 CVE-2008-2349 · GHSA-p67v-w2j9-rcfv

Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by…

LOW 38

Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direct request to install/newuser.php with the admin parameter set to 1.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02447 Published 2008-05-20 No fix listed CWE-264

TI-2008-02088 CVE-2008-2176 · GHSA-wr4w-jv29-c2wc

Cross-site scripting (XSS) vulnerability in admin/category.php in Zomplog 3.8.2 allows…

LOW 22

Cross-site scripting (XSS) vulnerability in admin/category.php in Zomplog 3.8.2 allows remote attackers to inject arbitrary web script or HTML via the catname parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01065 Published 2008-05-13 No fix listed CWE-79

Vulnerabilities

Filters

Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation

Zomplog 3.9 Cross-Site Scripting Vulnerability via Page Creation

Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by…

Cross-site scripting (XSS) vulnerability in admin/category.php in Zomplog 3.8.2 allows…