Vulnerabilities

TI-2026-09868 CVE-2026-11437 · GHSA-6g49-gvr8-2cj2

perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery

HIGH 66

A flaw has been found in perfree go-fastdfs-web up to 1.3.7.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00409 Published 2026-06-06 No fix listed CWE-918

TI-2026-05349 CVE-2026-6105 · GHSA-5xx4-vfw9-vhfp

perfree go-fastdfs-web doInstall InstallController.java improper authorization

LOW 36

A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00314 Published 2026-04-11 No fix listed CWE-266

TI-2026-03427 CVE-2026-3963 · GHSA-6mp3-5629-4c3x

perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded key

MEDIUM 61

A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00404 Published 2026-03-11 No fix listed CWE-320

TI-2025-37641 CVE-2025-60319 · GHSA-h976-6mc8-5w2v

PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing…

LOW 28

PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00264 Published 2025-10-30 No fix listed CWE-918

TI-2025-37803 CVE-2025-60735 · GHSA-5992-r8wx-j2j7

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function

HIGH 66

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00266 Published 2025-10-24 No fix listed CWE-434

TI-2025-37802 CVE-2025-60731 · GHSA-pv5m-gjc6-38wr

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function

HIGH 66

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00266 Published 2025-10-24 No fix listed CWE-434

TI-2025-37801 CVE-2025-60730 · GHSA-6hqx-gr9h-q72c

PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function

HIGH 66

PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00294 Published 2025-10-24 No fix listed CWE-459

TI-2025-37800 CVE-2025-60729 · GHSA-m76j-8hw5-pqgj

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function

MEDIUM 57

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00322 Published 2025-10-24 No fix listed CWE-126

TI-2025-21073 CVE-2025-29421 · GHSA-9hhq-2xjw-3mqv

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.

HIGH 66

PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00359 Published 2025-08-25 No fix listed CWE-284

TI-2025-21072 CVE-2025-29420 · GHSA-9629-m6p9-rfr8

PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.

HIGH 72

PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00909 Published 2025-08-25 No fix listed CWE-22

TI-2025-04633 CVE-2025-5164 · GHSA-q22v-8f6w-43w8

PerfreeBlog JWT JwtUtil hard-coded key

MEDIUM 61

A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00782 Published 2025-05-26 No fix listed CWE-320

TI-2025-21031 CVE-2025-29281 · GHSA-f6c5-v8pr-pwg7

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload…

HIGH 73

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00767 Published 2025-04-15 No fix listed CWE-94

TI-2025-21030 CVE-2025-29280 · GHSA-24hh-5wmw-c8j8

Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website…

MEDIUM 55

Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00278 Published 2025-04-15 No fix listed CWE-79

TI-2023-21565 CVE-2023-40825 · GHSA-6w87-437x-vx53

An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary…

HIGH 67

An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0123 Published 2023-08-28 No fix listed CWE-434

TI-2023-14231 CVE-2023-30333 · GHSA-3f4h-j993-69c6

An arbitrary file upload vulnerability in the component /admin/ThemeController.java of…

MEDIUM 51

An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00935 Published 2023-05-18 No fix listed CWE-434

TI-2023-13957 CVE-2023-29643 · GHSA-fm8q-26jf-5f8q

Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute…

MEDIUM 58

Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00457 Published 2023-05-01 No fix listed CWE-79

TI-2023-12393 CVE-2023-27757 · GHSA-hc99-gx4v-68qh

An arbitrary file upload vulnerability in the /admin/user/uploadImg component of…

MEDIUM 51

An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00935 Published 2023-03-15 No fix listed CWE-434

Vulnerabilities

Filters