mywebland 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk sql injection、vendor risk csrf, and パス処理の欠陥 があり、vendor surface software deployment and vendor surface production workloads の利用場面で vendor impact data exposure and ファイル上書き などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2008-6650 | del.php in miniBloggie 1.0 allows remote attackers to delete arbitrary posts via a direct request with a modified post_id parameter, a different vulnerability than CVE-2008-4628. | [email protected] | 5.0 | 1.96% | 2009-04-07 | 2026-06-16 |
| CVE-2008-5004 | SQL injection vulnerability in genscode.php in myWebland Bloggie Lite 0.0.2 beta allows remote attackers to execute arbitrary SQL commands via a crafted cookie. | [email protected] | 7.5 | 0.97% | 2008-11-10 | 2026-06-16 |
| CVE-2008-4650 | SQL injection vulnerability in viewevent.php in myEvent 1.6 allows remote attackers to execute arbitrary SQL commands via the eventdate parameter. | [email protected] | 7.5 | 1.01% | 2008-10-21 | 2026-06-16 |
| CVE-2008-4644 | hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For HTTP header. | [email protected] | 7.5 | 2.65% | 2008-10-21 | 2026-06-16 |
| CVE-2008-4643 | SQL injection vulnerability in hits.php in myWebland myStats allows remote attackers to execute arbitrary SQL commands via the sortby parameter. | [email protected] | 7.5 | 1.00% | 2008-10-21 | 2026-06-16 |
| CVE-2008-4628 | SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL commands via the post_id parameter. | [email protected] | 7.5 | 1.04% | 2008-10-20 | 2026-06-16 |
| CVE-2008-3080 | Cross-site request forgery (CSRF) vulnerability in admin.php in myWebland myBloggie 2.1.6 allows remote attackers to perform edit actions as administrators. NOTE: this can be leveraged to execute SQL commands by also exploiting CVE-2007-1899. | [email protected] | 5.1 | 0.41% | 2008-07-08 | 2026-06-16 |
| CVE-2007-3650 | myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via (1) an invalid year parameter to calendar.php, reached through index.php; (2) a direct request to common.php; and (3) a mode array parameter in the query string to login.php, which reveal the installation path in various error messages. | [email protected] | 5.3 | 1.00% | 2008-07-08 | 2026-06-16 |
| CVE-2007-1899 | Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via (1) the user_id parameter in a viewuser action to index.php, and allow remote authenticated administrators to execute arbitrary SQL commands via (2) the post_id parameter in an edit action to admin.php. | [email protected] | 5.1 | 0.92% | 2008-07-08 | 2026-06-16 |
| CVE-2007-3353 | PHP remote file inclusion vulnerability in includes/template.php in MyEvent 1.6 allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter. NOTE: a reliable third party disputes this issue, saying "the entire file is a class. | [email protected] | 7.5 | 1.35% | 2007-06-22 | 2026-06-16 |
| CVE-2007-3194 | Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the bloggie_root_path parameter to (1) config.php; (2) db.php, (3) template.php, (4) functions.php, and (5) classes.php in includes/; (6) viewmode.php; and (7) blog_body.php. NOTE: another researcher disputes the vulnerability because the files are protected against direct requests, contain no relevant include statements, or do not exist | [email protected] | 9.8 | 1.55% | 2007-06-12 | 2026-06-16 |
| CVE-2007-3003 | Multiple SQL injection vulnerabilities in myBloggie 2.1.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat_id or (2) year parameter to index.php in a viewuser action, different vectors than CVE-2005-1500 and CVE-2005-4225. | [email protected] | 7.5 | 1.01% | 2007-06-04 | 2026-06-16 |
| CVE-2007-0353 | Cross-site scripting (XSS) vulnerability in (1) index.php and (2) login.php in myBloggie 2.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO string. | [email protected] | 6.8 | 2.62% | 2007-01-18 | 2026-06-16 |
| CVE-2006-4163 | PHP remote file inclusion vulnerability in cls_fast_template.php in myWebland miniBloggie 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the fname parameter. NOTE: another researcher was unable to find a way to execute code after including it via a URL. CVE analysis as of 20060816 was inconclusive | [email protected] | 7.5 | 3.98% | 2006-08-16 | 2026-06-16 |
| CVE-2006-4083 | PHP remote file inclusion vulnerability in viewevent.php in myWebland myEvent 1.x allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter, a different vector than CVE-2006-4040. NOTE: the provenance of this information is unknown; the details are obtained from third party information. | [email protected] | 7.5 | 1.43% | 2006-08-11 | 2026-06-16 |
| CVE-2006-4043 | index.php in myWebland myBloggie 2.1.4 and earlier allows remote attackers to obtain sensitive information via a query that only specifies the viewdate mode, which reveals the table prefix in a SQL error message. | [email protected] | 5.0 | 1.68% | 2006-08-09 | 2026-06-16 |
| CVE-2006-4042 | Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) title, (2) url, (3) excerpt, or (4) blog_name parameters. | [email protected] | 7.5 | 1.81% | 2006-08-09 | 2026-06-16 |
| CVE-2006-4040 | PHP remote file inclusion vulnerability in myevent.php in myWebland myEvent 1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the myevent_path parameter. | [email protected] | 7.5 | 3.38% | 2006-08-09 | 2026-06-16 |
| CVE-2006-3905 | SQL injection vulnerability in Webland MyBloggie 2.1.3 allows remote attackers to execute arbitrary SQL commands via the (1) post_id parameter in index.php and (2) search function. | [email protected] | 7.5 | 1.45% | 2006-07-27 | 2026-06-16 |
| CVE-2006-3903 | CRLF injection vulnerability in (1) index.php and (2) admin.php in myWebland MyBloggie 2.1.3 allows remote attackers to hijack sessions and conduct cross-site scripting (XSS) attacks via a cookie. | [email protected] | 5.8 | 2.09% | 2006-07-27 | 2026-06-16 |