GCVE - cpe:2.3:a:nibbleblog:nibbleblog:4.0.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:nibbleblog:nibbleblog:4.0.5:*:*:*:*:*:*:*

part: a version: 4.0.5 update: *

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:github/dignajar/nibbleblog`	purl2cpe	2026-06-01 10:12:38.351201
`pkg:sourceforge/nibbleblog`	purl2cpe	2026-06-01 10:12:38.351203

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-7719`	vulnerable	2026-06-08 05:14:14.679165	Details available Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request. Published: 2019-02-11T03:00:00.000Z Updated: 2024-09-16T18:13:22.406Z Open on db.gcve.eu Reference links https://github.com/dignajar/nibbleblog/issues/138	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-6470`	vulnerable	2026-06-08 05:11:53.776576	Details available Nibbleblog 4.0.5 on macOS defaults to having .DS_Store in each directory, causing DS_Store information to leak. Published: 2018-02-01T13:00:00.000Z Updated: 2024-08-05T06:01:49.096Z Open on db.gcve.eu Reference links https://github.com/dignajar/nibbleblog/issues/120	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-16604`	vulnerable	2026-06-08 05:11:05.253468	Details available An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes (e.g., "${phpinfo()}"). Published: 2018-09-06T16:00:00.000Z Updated: 2024-09-16T23:50:42.050Z Open on db.gcve.eu Reference links https://github.com/dignajar/nibbleblog/issues/131	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.