Vulnerabilities
18 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-46494 | A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name parameter under a comment for an Article. NVD description · AI analysis pending | 5.4 | <1% | PoC |
| — | |
| CVE-2024-57369 | Clickjacking vulnerability in typecho v1.2.1. Clickjacking vulnerability in typecho v1.2.1. NVD description · AI analysis pending | 6.4 | <1% |
| — | ||
| CVE-2024-35540 | A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NVD description · AI analysis pending | 9.0 | 3% | PoC |
| — | |
| CVE-2024-35539 +1 in the same advisory: …35538 | Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerability allows attackers to post several comments before the spam protection checks if the comments are posted too frequently. NVD description · AI analysis pending | 6.5 group max | 1% | PoC |
| — | |
| CVE-2023-6615 | A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. A vulnerability, which was classified as problematic, has been found in Typecho 1.2.1. Affected by this issue is some unknown functionality of the file /admin/manage-users.php. The manipulation of the argument page leads to information disclosure. The exploit has been disclosed to the public and may be used. VDB-247250 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. NVD description · AI analysis pending | 5.3 group max | <1% | PoC |
| — | |
| CVE-2023-49967 | Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc. Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc. NVD description · AI analysis pending | 7.5 | <1% | PoC |
| — | |
| CVE-2023-36299 | A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general parameters in index.php. A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general parameters in index.php. NVD description · AI analysis pending | 8.8 | 2% | PoC |
| — | |
| CVE-2020-21038 | Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php. Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php. NVD description · AI analysis pending | 6.1 | <1% | PoC |
| — | |
| CVE-2023-30184 | A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter at /index.php/archives/1/comment. NVD description · AI analysis pending | 5.4 | <1% | PoC |
| — | |
| CVE-2023-27711 | Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.ph Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admin/manage-comments.php component. NVD description · AI analysis pending | 4.8 | <1% | PoC ×2 |
| — | |
| CVE-2023-24114 | typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php. typecho 1.1/17.10.30 was discovered to contain a remote code execution (RCE) vulnerability via install.php. NVD description · AI analysis pending | 9.8 | 1% | PoC |
| — | |
| CVE-2018-18753 | Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF. Typecho V1.1 allows remote attackers to send shell commands via base64-encoded serialized data, as demonstrated by SSRF. NVD description · AI analysis pending | 9.8 | 3% | PoC |
| — | |
| CVE-2017-16230 | In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit. NVD description · AI analysis pending | 5.4 | <1% | PoC |
| — |