mblog
by Mblog
CVEs (5)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-27280 | Hig | 0.51 | 7.8 | 0.01 | May 8, 2023 | OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected. | ||
| CVE-2020-19618 | Med | 0.35 | 5.4 | 0.01 | Apr 1, 2021 | Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing. | ||
| CVE-2020-19617 | Med | 0.35 | 5.4 | 0.01 | Apr 1, 2021 | Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile. | ||
| CVE-2020-19616 | Med | 0.35 | 5.4 | 0.01 | Apr 1, 2021 | Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing. | ||
| CVE-2021-46028 | Med | 0.28 | 4.3 | 0.00 | Jan 20, 2022 | In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted. |
- risk 0.51cvss 7.8epss 0.01
OS Command injection vulnerability in mblog 3.5.0 allows attackers to execute arbitrary code via crafted theme when it gets selected.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.
- risk 0.28cvss 4.3epss 0.00
In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted.