CVE-2025-5164

Affected software: PerfreeBlog 4.0.11. Vulnerability: in the function JwtUtil of the JWT Handler, leading to use of a hard-coded cryptographic key. Impact/exposure: exploit can be initiated remotely; attack complexity is high, with confidential data integrity and availability potentially affected...

CVE-2025-5164: Use of Hard-coded Cryptographic Key

A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is...

PT-2025-22876 · Unknown · Perfreeblog

Name of the Vulnerable Software and Affected Versions: PerfreeBlog version 4.0.11 Description: A vulnerability has been found in the function JwtUtil of the component JWT Handler, which leads to the use of a hard-coded cryptographic key. The attack can be initiated remotely, and the complexity of...

PerfreeBlog 安全漏洞

PerfreeBlog is PerfreeBlog open source, a java-based blog/CMS builder. A security vulnerability exists in PerfreeBlog version 4.0.11, which stems from the use of hard-coded encryption keys...

CVE-2023-29643

Cross Site Scripting XSS vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function...

CVE-2023-27757

An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file...

CVE-2023-30333

An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file...

CVE-2025-29281

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them...

CVE-2025-29280

Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code...

CVE-2025-29281

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them...

CVE-2025-29280

Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code...

CVE-2025-29280

A stored cross-site scripting (XSS) vulnerability exists in PerfreeBlog v4.0.11 within the website name field of the backend system settings interface. This flaw allows an attacker to insert and execute arbitrary malicious code. To mitigate risk, it is recommended to disable the website name fiel...

CVE-2025-29280

Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code...

CVE-2025-29281

In PerfreeBlog version 4.0.11 , a Java-based blog/CMS builder, regular users can exploit an arbitrary file upload vulnerability within the attach component . This flaw allows an attacker to upload arbitrary files and subsequently execute code within them. To mitigate this risk, it is recommended ...

PT-2025-16341 · Unknown · Perfreeblog

Name of the Vulnerable Software and Affected Versions: PerfreeBlog version 4.0.11 Description: A stored cross-site scripting vulnerability exists in the website name field of the backend system settings interface, allowing an attacker to insert and execute arbitrary malicious code. Recommendation...

CVE-2025-29281

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them...

CVE-2025-29281

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them...

CVE-2025-29281: Improper Control of Generation of Code

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them...

CVE-2025-29280

Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code...

PT-2025-16342 · Unknown · Perfreeblog

Name of the Vulnerable Software and Affected Versions: PerfreeBlog version 4.0.11 Description: The issue allows regular users to exploit an arbitrary file upload vulnerability in the attach component, enabling them to upload arbitrary files and execute code within them. Recommendations: For...