typecho vulnerabilities

Products

• typecho 3

Latest typecho CVEs

Newest publication first

1. CVE-2026-7025 Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery

   Published 2026-04-26

   Medium·CVSS 6.9

   A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forger...

2. CVE-2018-18753 Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF.

   Published 2018-10-29

   Critical·CVSS 9.8

   Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF.

3. CVE-2017-16230 In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-...

   Published 2017-10-30

   Medium·CVSS 5.4

   In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.