Alexander Palmo's vulnerability footprint centers on a small, niche web application—Simple PHP Blog—where the exposure recurs through input-handling and path-access issues characteristic of web-facing applications, particularly cross-site scripting and path-traversal flaws. The vendor's disclosures frequently acquire public exploit code, reflecting the accessibility and demonstrability of these application-layer vulnerabilities. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Alexander Palmo over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2005-2733HIGH upload_img_cgi.php in Simple PHP Blog (SPHPBlog) does not properly restrict file extensions of uploaded files, which could allow remote attackers to execute arbitrary code. | Aug 30, 2005 | 7.5 | 65 | NO | YES |
CVE-2006-1243HIGH Directory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitrary local files via directory t | Mar 15, 2006 | 7.5 | 32 | NO | YES |
CVE-2009-4421MEDIUM Directory traversal vulnerability in languages_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. | Dec 24, 2009 | 6.5 | 26 | NO | YES |
CVE-2005-2787MEDIUM comment_delete_cgi.php in Simple PHP Blog allows remote attackers to delete arbitrary files via the comment parameter. | Sep 2, 2005 | 5.0 | 24 | NO | YES |
CVE-2005-2192MEDIUM SimplePHPBlog 0.4.0 stores password hashes in config/password.txt with insufficient access control, which allows remote attackers to obtain passwords via a brute force attack. | Jul 11, 2005 | 5.0 | 23 | NO | YES |
CVE-2005-3473MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) entry, (2) blog_s | Nov 3, 2005 | 4.3 | 21 | NO | YES |
CVE-2005-1135MEDIUM Cross-site scripting (XSS) vulnerability in search.php for Simple PHP Blog (sphpBlog) 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter. | May 2, 2005 | 4.3 | 21 | NO | YES |
CVE-2007-5071HIGH Incomplete blacklist vulnerability in upload_img_cgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execute arbitrary code, as demonstrat | Sep 24, 2007 | 7.5 | 20 | NO | NO |
CVE-2011-5029MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the (1) entry pa | Dec 29, 2011 | 4.3 | 16 | NO | NO |
CVE-2005-0214MEDIUM Directory traversal vulnerability in Simple PHP Blog (SPHPBlog) 0.3.7c allows remote attackers to read or create arbitrary files via a .. (dot dot) in the entry parameter. | May 2, 2005 | 5.0 | 15 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Alexander Palmo.
Media articles that mention a CVE ID that affects a product developed by Alexander Palmo — matched by CVE ID, not by vendor name.