Filtered by vendor Phpblogger Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2007-4157 1 Phpblogger 1 Php-blogger 2024-11-21 N/A
PHPBlogger stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing an admin password hash via a direct request for data/pref.db. NOTE: this can be easily leveraged for administrative access because composing the authentication cookie only requires the password hash, not the cleartext version.
CVE-2006-3514 1 Phpblogger 1 Php-blogger 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in admin/actions.php in PHP-Blogger 2.2.5, and possibly earlier versions, allow remote attackers to execute arbitrary web script or HTML via the (1) name, (2) title, (3) news, (4) description, and (5) sitename parameters.