LiveActive security incident?Get immediate response
CVE Record

CVE-2018-10680: Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigat...

Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2018-10680 describes a stored cross-site scripting issue in Z-BlogPHP 1.5.2 involving the site title setting. The reported attack path requires administrator access. Business urgency is limited unless untrusted administrators exist, admin accounts are compromised, or the CMS is exposed in a shared-management environment. The vendor disputed the security relevance as a functional bug.

Executive priority

Treat this as a low-urgency review item unless Z-BlogPHP 1.5.2 is internet-facing with broad or weak administrator access. Prioritize admin account hygiene, version inventory, and vendor guidance over emergency response.

Technical view

The report says an administrator can save script-like content through the Website title setting, mapped to the ZC_BLOG_NAME parameter in zb_system/cmd.php. The source bundle provides no CVSS score, CWE, patch version, or confirmed affected CPEs. Impact depends on where that stored title is later rendered without safe output handling.

Likely exposure

Exposure appears limited to Z-BlogPHP 1.5.2 installations where administrators can modify the site title. Public exploitation risk is unclear from the provided sources, and the affected-product metadata is incomplete. Systems with tightly controlled admin access likely face lower practical risk.

Exploitation context

The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. The described path requires administrator privileges, so the most relevant scenarios are malicious insiders, delegated admin accounts, or already-compromised CMS administrator credentials.

Researcher notes

The source bundle is thin: no CVSS, CWE, patch version, CPE, or exploitation evidence is provided. The vendor dispute should be preserved in tracking notes. Validation should focus on confirming installed version, privilege model, and whether stored title data is rendered unsafely in local deployments.

Mitigation direction

  • Check Z-BlogPHP vendor guidance and issue history for any official fix or clarification.
  • Restrict CMS administrator access to trusted users only.
  • Review the configured website title for unexpected markup or script-like content.
  • Apply available Z-BlogPHP updates after confirming vendor release notes.
  • Use output encoding or sanitization controls where site title values are rendered.

Validation and detection

  • Inventory Z-BlogPHP deployments and identify any running version 1.5.2.
  • Confirm who has administrator access to affected CMS instances.
  • Review website title configuration for unexpected markup or script-like content.
  • Check change history or logs for recent modifications to the site title setting.
  • Document whether the vendor dispute changes local risk acceptance.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-10680 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.