Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
32 results
Aug 3, 2026A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat featureCVE-2026-52521 · Other software · reported by MITREHigh 8.1
A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026A weakness has been identified in Z-BlogPHP 1.7.4.3430.CVE-2026-8747 · Other software · reported by VulDBLow 2.1
A weakness has been identified in Z-BlogPHP 1.7.4.3430. This affects the function CheckComment of the file zb_system/function/c_system_event.php of the component Commend Approval Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026A vulnerability was identified in Z-BlogPHP 1.7.5.CVE-2026-6650 · Other software · reported by VulDBLow 2
A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/AppCentre/app_upload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 6, 2025Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template.CVE-2024-55529 · Other software · Zblogcn · reported by MITRECritical 9.8
Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 8, 2024A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML CVE-2024-39203 · Other software · Zblogcn · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2023Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter ofCVE-2020-23327 · Other software · Zblogcn · reported by MITREMedium 6.1
Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload in title parameter of the module management model.
- Product
- Zblogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2022A security issue was discovered in Z-BlogPHP <= 1.7.2.CVE-2022-40357 · Other software · Zblogcn · reported by MITRECritical 9.8
A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2021Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php.CVE-2020-29177 · Other software · Zblogcn · reported by MITRECritical 9.1
Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2021An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file.CVE-2020-29176 · Other software · Zblogcn · reported by MITREHigh 7.8
An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2021Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cCVE-2020-18268 · Other software · Zblogcn · reported by MITREMedium 6.1
Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php."
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2021Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control.CVE-2020-23352 · Other software · Zblogcn · reported by MITREHigh 7.5
Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zb_user/plugin/passwordvisit/include.php:passwordvisit_input_password() uses loose comparison to authenticate, which can be bypassed via magic hash values.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2018zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing.CVE-2018-19556 · Other software · Zblogcn · reported by MITREMedium 4.3
zb_system/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2018zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upCVE-2018-19463 · Other software · Zblogcn · reported by MITREHigh 8.8
zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zb_system/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP by uploading an image in current version." It also requires authentication
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2018CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code.CVE-2018-18842 · Other software · Zblogcn · reported by MITREHigh 8.8
CSRF exists in zb_users/plugin/AppCentre/theme.js.php in Z-BlogPHP 1.5.2.1935 (Zero), which allows remote attackers to execute arbitrary PHP code.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2018Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image atCVE-2018-18381 · Other software · Zblogcn · reported by MITREMedium 5.4
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2018An issue was discovered in Z-BlogPHP 2.0.0.CVE-2018-11209 · Other software · Zblogcn · reported by MITREHigh 7.2
An issue was discovered in Z-BlogPHP 2.0.0. zb_system/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to bypass intended access restrictions via a dictionary or rainbow-table attack. NOTE: the vendor declined to accept this as a valid issue
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2018An issue was discovered in Z-BlogPHP 2.0.0.CVE-2018-11208 · Other software · Zblogcn · reported by MITREMedium 4.8
An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the "copyright information office" field. NOTE: the vendor indicates that the product was not intended to block this type of XSS by a user with the admin privilege
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2018Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> WebsitCVE-2018-10680 · Other software · Zblogcn · reported by MITREMedium 6.1
Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2018Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter.CVE-2018-9169 · Other software · Zblogcn · reported by MITREMedium 4.8
Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. The component must be accessed directly by an administrator, or through CSRF.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxz.aliyun.comxz.aliyun.com
Apr 16, 2018The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugiCVE-2018-9153 · Other software · Zblogcn · reported by MITREHigh 7.2
The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directly by an administrator, or through CSRF.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxz.aliyun.comxz.aliyun.com
Mar 31, 2018Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code.CVE-2018-8893 · Other software · Zblogcn · reported by MITREHigh 8.8
Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2018In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php.CVE-2018-7737 · Other software · Zblogcn · reported by MITREMedium 5.3
In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. NOTE: the software maintainer disputes that this is a vulnerability
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2018In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter.CVE-2018-7736 · Other software · Zblogcn · reported by MITREMedium 6.1
In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2018Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php.CVE-2018-6846 · Other software · Zblogcn · reported by MITREMedium 5.3
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2018Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.CVE-2018-6656 · Other software · Zblogcn · reported by MITREMedium 6.5
Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.
- Product
- Z-blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2009index.php in BlogPHP 2.0 allows remote attackers to gain administrator privileges via a crafted email parameter in a register2 action.CVE-2008-6745 · Other software · Blogphp · reported by MITREHigh 7.5
index.php in BlogPHP 2.0 allows remote attackers to gain administrator privileges via a crafted email parameter in a register2 action.
- Product
- Blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Apr 7, 2009Multiple cross-site scripting (XSS) vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) user pCVE-2008-6631 · Other software · Blogphp · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in index.php in BlogPHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) user parameter in a sendmessage action and the (2) username parameter when registering a new user, different vectors than CVE-2008-0679.
- Product
- Blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2008BlogPHP 2.0 allows remote attackers to bypass authentication, and post (1) messages or (2) comments as an arbitrary user, via a modified blogphp_username field CVE-2008-2524 · Other software · Blogphp · reported by MITREMedium 5
BlogPHP 2.0 allows remote attackers to bypass authentication, and post (1) messages or (2) comments as an arbitrary user, via a modified blogphp_username field in a cookie.
- Product
- Blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comdavidsopas.com
Feb 11, 2008Cross-site scripting (XSS) vulnerability in index.php in BlogPHP 2.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.CVE-2008-0679 · Other software · Blogphp · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in index.php in BlogPHP 2.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
- Product
- Blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Feb 11, 2008SQL injection vulnerability in index.php in BlogPHP 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a page action.CVE-2008-0678 · Other software · Blogphp · reported by MITREMedium 6.8
SQL injection vulnerability in index.php in BlogPHP 2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a page action.
- Product
- Blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Jan 22, 2006Multiple SQL injection vulnerabilities in config.php in Insane Visions BlogPHP, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (CVE-2006-0372 · Other software · Insane Visions · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in config.php in Insane Visions BlogPHP, possibly 1.0, allow remote attackers to execute arbitrary SQL commands via the (1) blogphp_username or (2) blogphp_password parameter in a cookie.
- Product
- Blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comosvdb.org
Jan 18, 2006SQL injection vulnerability in index.php in BlogPHP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands and bypassCVE-2006-0318 · Other software · Insane Visions · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in BlogPHP 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the username parameter in a login action.
- Product
- Blogphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.