Blogengine.net Security Vulnerabilities and Issues — Blogengine.net CVE List

Lucene search

BlogengineBlogengine.net

4 matches found

CVE•added 2022/05/13 3:15 p.m.•68 views

CVE-2022-25591

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request.

9.1CVSS9.1AI score0.09744EPSS

CVE•added 2022/05/18 6:15 p.m.•65 views

CVE-2022-28921

A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server.

6.5CVSS6.5AI score0.00196EPSS

CVE•added 2022/12/19 8:15 p.m.•63 views

CVE-2022-41418

An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.

7.2CVSS7.2AI score0.00189EPSS

CVE•added 2022/09/02 5:15 a.m.•41 views

CVE-2022-36600

BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.

4.8CVSS5AI score0.001EPSS