1.5.1

DATE	CVE	VULNERABILITY TITLE	RISK
2018-11-22	CVE-2018-19463	Code Injection vulnerability in Zblogcn Z-Blogphp zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zb_system/admin/index.php?act=UploadMng URI. network low complexity zblogcn CWE-94	8.8
2018-04-16	CVE-2018-9169	Cross-site Scripting vulnerability in Zblogcn Z-Blogphp 1.5.1 Z-BlogPHP 1.5.1 has XSS via the zb_users/plugin/AppCentre/plugin_edit.php app_id parameter. network zblogcn CWE-79	3.5
2018-04-16	CVE-2018-9153	Unrestricted Upload of File with Dangerous Type vulnerability in Zblogcn Z-Blogphp 1.5.1 The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the app_id parameter to zb_users/plugin/AppCentre/plugin_edit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. network low complexity zblogcn CWE-434	6.5
2018-03-31	CVE-2018-8893	Cross-Site Request Forgery (CSRF) vulnerability in Zblogcn Z-Blogphp 1.5.1 Z-BlogPHP 1.5.1 Zero has CSRF in plugin_edit.php, resulting in the ability to execute arbitrary PHP code. network zblogcn CWE-352	6.8
2018-02-08	CVE-2018-6846	Information Exposure vulnerability in Zblogcn Z-Blogphp 1.5.1 Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php. network low complexity zblogcn CWE-200	5.0
2018-02-06	CVE-2018-6656	Cross-Site Request Forgery (CSRF) vulnerability in Zblogcn Z-Blogphp 1.5.1 Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories. network zblogcn CWE-352	5.8