Blesta vulnerabilities

Products

• Blesta 4

Latest Blesta CVEs

Newest publication first

1. CVE-2026-25616 Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.

   Published 2026-02-03

   Medium·CVSS 6.1 EPSS 0.42%

   Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.

2. CVE-2026-25615 Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.

   Published 2026-02-03

   High·CVSS 7.2 EPSS 0.52%

   Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.

3. CVE-2026-25614 Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.

   Published 2026-02-03

   High·CVSS 7.5 EPSS 0.44%

   Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.

4. CVE-2024-25859 A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code.

   Published 2024-02-28

   High·CVSS 7.1 EPSS 0.31%

   A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.