{"id":"CVE-2020-23352","details":"Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. PHP loose comparison and a magic hash can be used to bypass authentication. zb_user/plugin/passwordvisit/include.php:passwordvisit_input_password() uses loose comparison to authenticate, which can be bypassed via magic hash values.","modified":"2026-09-16T11:45:17.206699629Z","published":"2021-01-27T16:15:12.717Z","database_specific":{"unresolved_ranges":[{"vendor_product":"zblogcn:z-blogphp","cpes":["cpe:2.3:a:zblogcn:z-blogphp:1.6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.6.0"},{"last_affected":"1.6.0"}],"source":"CPE_STRING"}]},"references":[{"type":"FIX","url":"https://github.com/zblogcn/zblogphp/commit/a67607fc984f976d6b36b8870dffaabd9d6c9d5e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zblogcn/zblogphp","events":[{"introduced":"0"},{"fixed":"a67607fc984f976d6b36b8870dffaabd9d6c9d5e"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v1.6.0","1740","1626","1.5.0.1525-8","1.5.0.1525-7","1.5.0.1525-6","1.5.0.1525-5","1.5.0.1525-4","1.5.0.1525-2","1.5.0.1525"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-23352.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}