Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2768▼ 428 respecto a la semana anterior

Críticas / altas1324▼ 116 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)265▼ 243 respecto a la semana anterior

7 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2022-37679	Modificada	Media (4.8)	0.48%	—	Miniblog.core Project Miniblog.core	2/9/2022	17/6/2026	Miniblog.Core v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blog/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Excerpt field.
CVE-2019-9842	Modificada	Alta (7.2)	2.2%	—	Miniblog Project Miniblog	14/6/2019	17/6/2026	madskristensen MiniBlog through 2018-05-18 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in app_code/handlers/PostHandler.cs writes a decoded base64 string to a file without validating the extension.
CVE-2019-9845	Modificada	Crítica (9.8)	2.5%	—	Miniblog.core Project Miniblog.core	16/4/2019	17/6/2026	madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in Controllers/BlogController.cs writes a decoded base64 string to a file without validating the extension.
CVE-2008-6650	Modificada	Media (5)	2.0%	💥 Exploit	Mywebland Minibloggie	7/4/2009	16/6/2026	del.php in miniBloggie 1.0 allows remote attackers to delete arbitrary posts via a direct request with a modified post_id parameter, a different vulnerability than CVE-2008-4628.
CVE-2008-4628	Modificada	Alta (7.5)	1.0%	💥 Exploit	Mywebland Minibloggie	21/10/2008	16/6/2026	SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL commands via the post_id parameter.
CVE-2006-4163	Modificada	Alta (7.5)	4.2%	💥 Exploit	Mywebland Minibloggie	16/8/2006	16/6/2026	PHP remote file inclusion vulnerability in cls_fast_template.php in myWebland miniBloggie 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the fname parameter. NOTE: another researcher was unable to find a way to execute code after including it via a URL. CVE analysis as of 20060816…
CVE-2006-0417	Modificada	Alta (7.5)	2.0%	💥 Exploit	Mywebland Minibloggie	25/1/2006	16/6/2026	SQL injection vulnerability in login.php in miniBloggie 1.0 and earlier, when gpc_magic_quotes is disabled, allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username and (2) password parameters.