CVE-2018-10680

Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.
References
Link Resource
https://github.com/zblogcn/zblogphp/issues/185 Exploit Third Party Advisory
https://github.com/zblogcn/zblogphp/issues/205 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:zblogcn:z-blogphp:1.5.2:*:*:*:*:*:*:*

History

07 Nov 2023, 02:51

Type Values Removed Values Added
Summary ** DISPUTED ** Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug." Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.

Information

Published : 2018-05-02 19:29

Updated : 2024-08-05 08:15


NVD link : CVE-2018-10680

Mitre link : CVE-2018-10680

CVE.ORG link : CVE-2018-10680


JSON object : View

Products Affected

zblogcn

  • z-blogphp
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')