Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

myBloggie 2.1.6 lets attackers run database commands

CVE-2007-1899 · published 18 years ago
Summary

The blog software myBloggie version 2.1.6 can be tricked into running harmful database instructions. An unauthenticated attacker can exploit the user profile view, and a logged‑in administrator can misuse the edit post function to do the same. Apply the vendor’s update or patch as soon as possible and limit access to trusted administrators.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mywebland mybloggie 2.1.6
cpe:2.3:a:mywebland:mybloggie:2.1.6:*:*:*:*:*:*:*
Original advisory text
Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via (1) the user_id parameter in a viewuser action to index.php, and all...
Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via (1) the user_id parameter in a viewuser action to index.php, and allow remote authenticated administrators to execute arbitrary SQL commands via (2) the post_id parameter in an edit action to admin.php.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published9 Jul 2008
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2007-1899 · NVD
Track software like this
Free during beta