blog project vulnerabilities

Products

• blog 3

Latest blog project CVEs

Newest publication first

1. CVE-2022-23626 Insufficient file checks in m1k1o/blog

   Published 2022-02-08

   High·CVSS 8.8 EPSS 9.9%

   m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions imagecreatefrom* and image* have not been checked properly. Although PHP issued warnings and the upload function returned false, the original file (that could contain a malicious payload) was...

2. CVE-2017-14346 upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.

   Published 2017-09-12

   Critical·CVSS 9.8 EPSS 2.1%

   upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.

3. CVE-2017-14345 SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.

   Published 2017-09-12

   Critical·CVSS 9.8 EPSS 1.1%

   SQL Injection exists in tianchoy/blog through 2017-09-12 via the id parameter to view.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.