CVE-2018-10680: XSS
DISPUTED Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zbsystem/cmd.php ZCBLOGNAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10680?
CVE-2018-10680 is considered a medium severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2018-10680?
To fix CVE-2018-10680, ensure that input validation and sanitization are implemented for the ZC_BLOG_NAME parameter in Z-BlogPHP 1.5.2.
Who is affected by CVE-2018-10680?
CVE-2018-10680 affects users of Z-BlogPHP version 1.5.2 who have administrative access to the website settings.
What type of vulnerability is CVE-2018-10680?
CVE-2018-10680 is a stored cross-site scripting (XSS) vulnerability.
Can CVE-2018-10680 be exploited remotely?
CVE-2018-10680 requires an administrator to be deceived into entering a malicious payload, making remote exploitation less straightforward.