Priority HIGH 73
In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00767 · Published 2025-04-15 · No fix listed CWE-94
Priority HIGH 72
PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00909 · Published 2025-08-25 · No fix listed CWE-22
Priority HIGH 67
An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0123 · Published 2023-08-28 · No fix listed CWE-434
Priority HIGH 66
A flaw has been found in perfree go-fastdfs-web up to 1.3.7.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00409 · Published 2026-06-06 · No fix listed CWE-918
Priority HIGH 66
PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00266 · Published 2025-10-24 · No fix listed CWE-434
Priority HIGH 66
PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function
CVSS 3.1HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00266 · Published 2025-10-24 · No fix listed CWE-434
Priority HIGH 66
PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function
CVSS 3.1HIGH 7.6· Network · No auth · User interaction · EPSS 0.00294 · Published 2025-10-24 · No fix listed CWE-459
Priority HIGH 66
PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00359 · Published 2025-08-25 · No fix listed CWE-284
Priority MEDIUM 61
A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00404 · Published 2026-03-11 · No fix listed CWE-320
Priority MEDIUM 61
A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00782 · Published 2025-05-26 · No fix listed CWE-320
Priority MEDIUM 58
Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00457 · Published 2023-05-01 · No fix listed CWE-79
Priority MEDIUM 57
PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00322 · Published 2025-10-24 · No fix listed CWE-126
Priority MEDIUM 55
Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00272 · Published 2025-04-15 · No fix listed CWE-79
Priority MEDIUM 51
An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00935 · Published 2023-05-18 · No fix listed CWE-434
Priority MEDIUM 51
An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00935 · Published 2023-03-15 · No fix listed CWE-434
Priority LOW 36
A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00309 · Published 2026-04-11 · No fix listed CWE-266
Priority LOW 28
PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00264 · Published 2025-10-30 · No fix listed CWE-918
THREATIST.IORead the docs