CVE-2018-7736

** DISPUTED ** In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability.

Date published : 2018-03-06

https://github.com/zblogcn/zblogphp/issues/205

https://www.exploit-db.com/exploits/44406/