CyberSecBulletin

Zhblue vulnerabilities

We track 2 vulnerabilities in Zhblue products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on January 27, 2026.

2vulnerabilities
2critical
0high
0exploited
9.4average CVSS score

Latest Zhblue vulnerabilities

  • 9.8 Critical severity

    hustoj: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2026-24479ZhblueEPSS 8.13%

    HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_import_qduoj.php and problem_import_hoj.php modules fail to properly sanitize filenames within uploaded ZIP archives. Atta

  • 9.0 Critical severity

    hustoj: Improper Neutralization of Formula Elements in a CSV File

    CVE-2026-23873Zhblue

    hustoj is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. All versions are vulnerable to CSV Injection (Formula Injection) through the contest rank export functionality (contestrank.xls.php and admin/ranklist_export.php