CVE-2018-19463

Name: CVE-2018-19463
Creator: NVD / NIST
Published: 2018-11-22T21:29:00.227+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.17%

Last modified Jun 17, 2026

CVE-2018-19463 is a vulnerability of currently unknown severity. zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zb_system/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. EPSS estimates a 2.17% chance of exploitation in the next 30 days.

Description

zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zb_system/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP by uploading an image in current version." It also requires authentication

Metrics

EPSS Probability

2.17%

80.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-94

Affected Software

Vendor	Product	Versions
Zblogcn	Z-Blogphp	<= 1.5.1

References

https://github.com/novysodope/Z-BlogPHP1.5Zero/blob/master/GetshellBroken Link, Third Party Advisory
https://github.com/zblogcn/zblogphp/issues/205Third Party Advisory
https://github.com/novysodope/Z-BlogPHP1.5Zero/blob/master/GetshellBroken Link, Third Party Advisory
https://github.com/zblogcn/zblogphp/issues/205Third Party Advisory

Timeline

Published: Nov 22, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-19463?

How severe is CVE-2018-19463?

Severity scoring for CVE-2018-19463 is pending analysis. The EPSS model estimates a 2.17% probability of exploitation in the next 30 days.

How do I fix CVE-2018-19463?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-19463?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST