nibbleblog records
7 published records for vendor nibbleblog.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 1 · 14.3%
- Pre-auth RCE
- 1
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-94 Improper Control of Generation of Code ('Code Injection')2
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
7 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
41Plan | CVE-2015-6967Weaponized | Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary cnibbleblog · nibbleblog | Medium6.5 | — | 49.3% | Sep 16, 2015 |
40Plan | CVE-2019-7719No exploit | Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.phnibbleblog · nibbleblog · CWE-94 | Critical9.8 | — | 1.7% | Feb 11, 2019 |
30Monitor | CVE-2020-23356No exploit | dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for passwordnibbleblog · nibbleblog | High7.5 | — | 0.9% | Jan 27, 2021 |
28Monitor | CVE-2018-16604No exploit | An issue was discovered in Nibbleblog v4.0.5.nibbleblog · nibbleblog · CWE-94 | High7.2 | — | 1.5% | Sep 6, 2018 |
27Monitor | CVE-2015-6966No exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication ofnibbleblog · nibbleblog · CWE-352 | Medium6.8 | — | 0.7% | Sep 16, 2015 |
21Monitor | CVE-2018-6470No exploit | Nibbleblog 4.0.5 on macOS defaults to having .DS_Store in each directory, causing DS_Store information to leak.nibbleblog · nibbleblog · CWE-200 | Medium5.3 | — | 1.0% | Feb 1, 2018 |
18Monitor | CVE-2014-8996No exploit | Multiple cross-site scripting (XSS) vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitrary web script or HTMLnibbleblog · nibbleblog · CWE-79 | Medium4.3 | — | 1.8% | Nov 20, 2014 |
- CVE-2015-696741Plan
Unrestricted file upload vulnerability in the My Image plugin in Nibbleblog before 4.0.5 allows remote administrators to execute arbitrary c
MediumCVSS 6.5WeaponizedEPSS 49%nibbleblog · nibbleblogSep 16, 2015
- CVE-2019-771940Plan
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.ph
CriticalCVSS 9.8No exploitEPSS 1%nibbleblog · nibbleblogFeb 11, 2019
- CVE-2020-2335630Monitor
dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password
HighCVSS 7.5No exploitEPSS 0%nibbleblog · nibbleblogJan 27, 2021
- CVE-2018-1660428Monitor
An issue was discovered in Nibbleblog v4.0.5.
HighCVSS 7.2No exploitEPSS 1%nibbleblog · nibbleblogSep 6, 2018
- CVE-2015-696627Monitor
Multiple cross-site request forgery (CSRF) vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of
MediumCVSS 6.8No exploitEPSS 0%nibbleblog · nibbleblogSep 16, 2015
- CVE-2018-647021Monitor
Nibbleblog 4.0.5 on macOS defaults to having .DS_Store in each directory, causing DS_Store information to leak.
MediumCVSS 5.3No exploitEPSS 1%nibbleblog · nibbleblogFeb 1, 2018
- CVE-2014-899618Monitor
Multiple cross-site scripting (XSS) vulnerabilities in Nibbleblog before 4.0.2 allow remote attackers to inject arbitrary web script or HTML
MediumCVSS 4.3No exploitEPSS 1%nibbleblog · nibbleblogNov 20, 2014