Blogengine.net Security Vulnerabilities and Issues — Blogengine.net CVE List

Lucene search

BlogengineBlogengine.net

6 matches found

CVE•added 2023/01/18 2:15 p.m.•51 views

CVE-2022-41417

BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.

9.8CVSS9.3AI score0.0007EPSS

CVE•added 2023/06/26 8:15 p.m.•51 views

CVE-2023-33404

An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.

9.8CVSS9.5AI score0.84342EPSS

CVE•added 2023/03/06 7:15 a.m.•49 views

CVE-2023-22857

A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post.

8.5CVSS6.5AI score0.00088EPSS

CVE•added 2023/06/21 9:15 p.m.•46 views

CVE-2023-33405

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.

6.1CVSS6.2AI score0.49268EPSS

CVE•added 2023/03/06 7:15 a.m.•41 views

CVE-2023-22858

An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.

5.3CVSS5.8AI score0.00059EPSS

CVE•added 2023/03/06 7:15 a.m.•34 views

CVE-2023-22856

A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file.

8.5CVSS6.2AI score0.00091EPSS