perfree
Products
2- 14 CVEs
- 3 CVEs
Recent CVEs
17| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-30333 | Cri | 0.64 | 9.8 | 0.01 | May 18, 2023 | An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file. | ||
| CVE-2023-27757 | Cri | 0.64 | 9.8 | 0.01 | Mar 15, 2023 | An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file. | ||
| CVE-2025-29281 | Hig | 0.57 | 8.8 | 0.01 | Apr 15, 2025 | In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them. | ||
| CVE-2025-60735 | Hig | 0.49 | 7.6 | 0.00 | Oct 24, 2025 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function | ||
| CVE-2025-60731 | Hig | 0.49 | 7.6 | 0.00 | Oct 24, 2025 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function | ||
| CVE-2025-60730 | Hig | 0.49 | 7.6 | 0.00 | Oct 24, 2025 | PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function | ||
| CVE-2025-29421 | Hig | 0.49 | 7.5 | 0.00 | Aug 25, 2025 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function. | ||
| CVE-2025-29420 | Hig | 0.49 | 7.5 | 0.01 | Aug 25, 2025 | PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function. | ||
| CVE-2026-11437 | Hig | 0.47 | 7.3 | 0.00 | Jun 6, 2026 | A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installation Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The… | ||
| CVE-2026-6105 | Hig | 0.47 | 7.3 | 0.00 | Apr 11, 2026 | A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The… | ||
| CVE-2023-40825 | Hig | 0.47 | 7.2 | 0.01 | Aug 28, 2023 | An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list. | ||
| CVE-2023-29643 | Med | 0.35 | 5.4 | 0.00 | May 1, 2023 | Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function. | ||
| CVE-2025-60729 | Med | 0.34 | 5.3 | 0.00 | Oct 24, 2025 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function | ||
| CVE-2025-29280 | Med | 0.31 | 4.8 | 0.00 | Apr 15, 2025 | Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code. | ||
| CVE-2026-3963 | Low | 0.24 | 3.7 | 0.00 | Mar 11, 2026 | A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7. This affects the function rememberMeManager of the file src/main/java/com/perfree/config/ShiroConfig.java of the component Apache Shiro RememberMe. Performing a manipulation results in use of hard-coded… | ||
| CVE-2025-5164 | Low | 0.24 | 3.7 | 0.01 | May 26, 2025 | A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity… | ||
| CVE-2025-60319 | Med | 0.00 | 6.5 | 0.00 | Oct 30, 2025 | PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java). |
- risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.
- risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file.
- risk 0.57cvss 8.8epss 0.01
In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them.
- risk 0.49cvss 7.6epss 0.00
PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function
- risk 0.49cvss 7.6epss 0.00
PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function
- risk 0.49cvss 7.6epss 0.00
PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function
- risk 0.49cvss 7.5epss 0.00
PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.
- risk 0.49cvss 7.5epss 0.01
PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.
- risk 0.47cvss 7.3epss 0.00
A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installation Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The…
- risk 0.47cvss 7.3epss 0.00
A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The…
- risk 0.47cvss 7.2epss 0.01
An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list.
- risk 0.35cvss 5.4epss 0.00
Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.
- risk 0.34cvss 5.3epss 0.00
PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function
- risk 0.31cvss 4.8epss 0.00
Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code.
- risk 0.24cvss 3.7epss 0.00
A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7. This affects the function rememberMeManager of the file src/main/java/com/perfree/config/ShiroConfig.java of the component Apache Shiro RememberMe. Performing a manipulation results in use of hard-coded…
- risk 0.24cvss 3.7epss 0.01
A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity…
- risk 0.00cvss 6.5epss 0.00
PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).