Zrlog

12 CVEs across 1 Zrlog products. Browse Zrlog vulnerabilities, severities, and proof-of-concept exploits.

Zrlog products with known CVEs

ProductCVEs
Zrlog12
Zrlog CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-45872Critical9.82025-07-01zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.
CVE-2020-27514Critical9.12023-08-11Directory Traversal vulnerability in delete function in admin.api.TemplateController in ZrLog version 2.1.15, allows remote attackers to delete arbitrary files…
CVE-2020-21052Medium6.12023-06-20Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of the /post/addComment…
CVE-2021-44094High7.82021-11-28ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file
CVE-2021-44093Critical9.82021-11-28A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file…
CVE-2020-18066Medium6.12021-06-29Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
CVE-2020-21316Medium6.12021-06-15A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stole…
CVE-2020-19005Medium5.72020-08-25zrlog v2.1.0 has a vulnerability with the permission check. If admin account is logged in, other unauthorized users can download the database backup file direc…
CVE-2019-16643Medium5.42019-09-20An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area.
CVE-2018-17079Medium6.12019-06-19An issue was discovered in ZRLOG 2.0.1. There is a Stored XSS vulnerability in the nickname field of the comment area.
CVE-2018-17421Medium6.12019-03-07An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathname.
CVE-2018-17420High7.22019-03-07An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter.