VYPR
← A Blog

Vendor CVEs

A Blog

All CVEs

33 total · sorted by risk
  • CVE-2022-21142CriFeb 24, 2022
    Appleple
    A Blog CMS
    risk 0.64cvss 9.8epss 0.02

    Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.39, Ver.2.10.x series versions prior to Ver.2.10.43, and Ver.2.11.x series versions prior to Ver.2.11.41 allows a remote unauthenticated…

  • CVE-2024-23348HigJan 23, 2024
    Appleple
    A Blog CMS
    risk 0.57cvss 8.8epss 0.01

    Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a…

  • CVE-2024-23180HigJan 23, 2024
    Appleple
    A Blog CMS
    risk 0.57cvss 8.8epss 0.01

    Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a…

  • CVE-2025-36560HigMay 19, 2025
    Appleple
    A Blog CMS
    risk 0.56cvss 8.6epss 0.00

    Server-side request forgery vulnerability exists in a-blog cms multiple versions. If this vulnerability is exploited, a remote unauthenticated attacker may gain access to sensitive information by sending a specially crafted request.

  • CVE-2024-23182HigJan 23, 2024
    Appleple
    A Blog CMS
    risk 0.53cvss 8.1epss 0.01

    Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a…

  • CVE-2025-29461HigApr 17, 2025
    A Blog
    a-blogcms
    risk 0.49cvss 7.6epss 0.00

    An issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path.

  • CVE-2025-31103HigMar 31, 2025
    Appleple
    A Blog CMS
    risk 0.49cvss 7.5epss 0.00

    Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.

  • CVE-2024-31396MedMay 22, 2024
    Appleple
    A Blog CMS
    risk 0.43cvss 6.6epss 0.00

    Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the product may execute an…

  • CVE-2024-31394MedMay 22, 2024
    Appleple
    A Blog CMS
    risk 0.42cvss 6.5epss 0.01

    Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier…

  • CVE-2024-27279MedMar 12, 2024
    Appleple
    A Blog CMS
    risk 0.42cvss 6.5epss 0.01

    Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.2.11.x series Ver.2.11.59 and earlier, Ver.2.10.x series Ver.2.10.51 and earlier, and Ver.2.9 and earlier versions. If this vulnerability…

  • CVE-2022-23810MedFeb 24, 2022
    Appleple
    A Blog CMS
    risk 0.42cvss 6.5epss 0.01

    Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series…

  • CVE-2024-31395MedMay 22, 2024
    Appleple
    A Blog CMS
    risk 0.40cvss 6.1epss 0.00

    Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier…

  • CVE-2024-23181MedJan 23, 2024
    Appleple
    A Blog CMS
    risk 0.40cvss 6.1epss 0.00

    Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a…

  • CVE-2022-24374MedFeb 24, 2022
    Appleple
    A Blog CMS
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to…

  • CVE-2022-23916MedFeb 24, 2022
    Appleple
    A Blog CMS
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to…

  • CVE-2019-6034MedDec 26, 2019
    Appleple
    A Blog CMS
    risk 0.40cvss 6.1epss 0.01

    a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8.x) allows arbitrary scripts to be executed in the context of the application due to unspecified vectors.

  • CVE-2019-6033MedDec 26, 2019
    Appleple
    A Blog CMS
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting vulnerability in a-blog cms versions prior to Ver.2.10.23 (Ver.2.10.x), Ver.2.9.26 (Ver.2.9.x), and Ver.2.8.64 (Ver.2.8.x) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2025-32999MedMay 19, 2025
    Appleple
    A Blog CMS
    risk 0.35cvss 5.4epss 0.00

    Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is…

  • CVE-2024-30419MedMay 22, 2024
    Appleple
    A Blog CMS
    risk 0.35cvss 5.4epss 0.00

    Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series versions prior to Ver.3.0.32, Ver.2.11.x series versions prior to Ver.2.11.61, Ver.2.10.x series versions prior to Ver.2.10.53, and Ver.2.9 and earlier…

  • CVE-2024-23782MedJan 28, 2024
    Appleple
    A Blog CMS
    risk 0.35cvss 5.4epss 0.00

    Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier…

  • CVE-2024-23183MedJan 23, 2024
    Appleple
    A Blog CMS
    risk 0.35cvss 5.4epss 0.00

    Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a…

  • CVE-2025-41429MedMay 19, 2025
    Appleple
    A Blog CMS
    risk 0.31cvss 4.8epss 0.00

    a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a legitimate user's session.

  • CVE-2024-25559MedFeb 15, 2024
    Appleple
    A Blog CMS
    risk 0.31cvss 4.7epss 0.00

    URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. If an attacker sends a specially crafted request, the administrator of the product may be forced to access an arbitrary website when clicking a link in the audit log.

  • CVE-2024-30420MedMay 22, 2024
    Appleple
    A Blog CMS
    risk 0.29cvss 4.4epss 0.00

    Server-side request forgery (SSRF) vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series versions prior to Ver.3.0.32. If this vulnerability is exploited, a user with an administrator or higher privilege who can log in to the…

  • CVE-2025-27566LowMay 19, 2025
    Appleple
    A Blog CMS
    risk 0.25cvss 3.8epss 0.00

    Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited,…

  • CVE-2010-4917Oct 8, 2011
    A Blog
    A Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in sources/search.php in A-Blog 2.0 allows remote attackers to execute arbitrary SQL commands via the words parameter.

  • CVE-2008-0676Feb 12, 2008
    A Blog
    A Blog
    risk 0.03cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in search.php in A-Blog 2 allows remote attackers to inject arbitrary web script or HTML via the words parameter.

  • CVE-2008-0677Feb 12, 2008
    A Blog
    A Blog
    risk 0.03cvss —epss 0.01

    SQL injection vulnerability in blog.php in A-Blog 2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a news action.

  • CVE-2006-6729Dec 26, 2006
    A Blog
    A Blog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in a-blog 1.51 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2006-5135Oct 3, 2006
    A Blog
    A Blog
    risk 0.03cvss —epss 0.02

    Multiple PHP remote file inclusion vulnerabilities in A-Blog 2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) open_box, (2) middle_box, and (3) close_box parameters in (a) sources/myaccount.php; the (4) navigation_end parameter in (b)…

  • CVE-2006-5092Sep 29, 2006
    A Blog
    A Blog
    risk 0.03cvss —epss 0.04

    PHP remote file inclusion vulnerability in navigation/menu.php in A-Blog 2 allows remote attackers to execute arbitrary PHP code via a URL in the navigation_start parameter.

  • CVE-2005-0945May 2, 2005
    Asp Press
    Acs Blog
    risk 0.03cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in ACS Blog 1.1.1 allows remote attackers to inject arbitrary web script or HTML via onmouseover or onload events in (1) img, (2) link, or (3) mail tags.

  • CVE-2005-1288May 2, 2005
    Asp Press
    Acs Blog
    risk 0.00cvss —epss 0.02

    inc_login_check.asp ACS Blog 0.8 through 1.1.3 allows remote attackers to gain administrator privileges via the "in" value in a cookie.