Simple Php Blog
Monthly
Cross-site scripting in Philipinho's Simple-PHP-Blog allows remote unauthenticated attackers to inject malicious JavaScript via the Username parameter on /login.php, executing arbitrary script in a victim's browser upon interaction with a crafted request. All commits up to 94b5d3e57308bce5dfbc44c3edafa9811893d958 are affected, with no fixed version available due to a rolling release model. A public proof-of-concept exploit exists (EPSS: 0.01%, 3rd percentile), though real-world impact is substantially limited by the vendor's own characterization of the product as intended for educational purposes only.
SQL injection in Philipinho Simple-PHP-Blog up to commit 94b5d3e allows low-privileged remote attackers to manipulate SQL queries via the /edit.php endpoint. An exploit is publicly available, but no active exploitation in the wild is reported. EPSS probability is very low (0.04%).
Cross-site scripting in Philipinho's Simple-PHP-Blog allows remote unauthenticated attackers to inject malicious JavaScript via the Username parameter on /login.php, executing arbitrary script in a victim's browser upon interaction with a crafted request. All commits up to 94b5d3e57308bce5dfbc44c3edafa9811893d958 are affected, with no fixed version available due to a rolling release model. A public proof-of-concept exploit exists (EPSS: 0.01%, 3rd percentile), though real-world impact is substantially limited by the vendor's own characterization of the product as intended for educational purposes only.
SQL injection in Philipinho Simple-PHP-Blog up to commit 94b5d3e allows low-privileged remote attackers to manipulate SQL queries via the /edit.php endpoint. An exploit is publicly available, but no active exploitation in the wild is reported. EPSS probability is very low (0.04%).