CVE-2026-6650

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/AppCentre/app_upload.php of the component ZBA File Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-284 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Apr 20, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-66512.4A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of the component Invent CVE-2026-66524.7A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEng CVE-2026-66539.8Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of CVE-2026-66545.1Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` and `ThinVec::clear` functions in the thin_vec crate. A panic in `ptr::drop_in_pl CVE-2026-66567.5Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. CVE-2026-665639.8Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.CVE-2026-665649.8Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.CVE-2026-665659.8Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.CVE-2026-665668.1Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.CVE-2026-665679.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.CVE-2026-665689.8Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.CVE-2026-665699.8Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.