perfree vulnerabilities

Products

• perfreeblog 14
• go-fastdfs-web 3

Latest perfree CVEs

Newest publication first

1. CVE-2026-11437 perfree go-fastdfs-web Installation Endpoint checkServer server-side request forgery

   Published 2026-06-06

   Medium·CVSS 6.9 EPSS 0.41%

   A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installation Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. The ex...

2. CVE-2026-6105 perfree go-fastdfs-web doInstall InstallController.java improper authorization

   Published 2026-04-11

   Medium·CVSS 6.9 EPSS 0.31%

   A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller/InstallController.java of the component doInstall Interface. The manipulation leads to improper authorization. The attac...

3. CVE-2026-3963 perfree go-fastdfs-web Apache Shiro RememberMe ShiroConfig.java rememberMeManager hard-coded key

   Published 2026-03-11

   Medium·CVSS 6.3 EPSS 0.40%

   A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7. This affects the function rememberMeManager of the file src/main/java/com/perfree/config/ShiroConfig.java of the component Apache Shiro RememberMe. Performing a manipulation results in use of hard-coded cr...

4. CVE-2025-60319 PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).

   Published 2025-10-30

   Medium·CVSS 6.5 EPSS 0.26%

   PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).

5. CVE-2025-60735 PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function

   Published 2025-10-24

   High·CVSS 7.6 EPSS 0.27%

   PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function

6. CVE-2025-60731 PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function

   Published 2025-10-24

   High·CVSS 7.6 EPSS 0.27%

   PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function

7. CVE-2025-60730 PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function

   Published 2025-10-24

   High·CVSS 7.6 EPSS 0.29%

   PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function

8. CVE-2025-60729 PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function

   Published 2025-10-24

   Medium·CVSS 5.3 EPSS 0.32%

   PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function

9. CVE-2025-29420 PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.

   Published 2025-08-25

   High·CVSS 7.5 EPSS 0.91%

   PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.

10. CVE-2025-29421 PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.

    Published 2025-08-25

    High·CVSS 7.5 EPSS 0.36%

    PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.

11. CVE-2025-5164 PerfreeBlog JWT JwtUtil hard-coded key

    Published 2025-05-26

    Medium·CVSS 6.3 EPSS 0.78%

    A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity o...

12. CVE-2025-29280 Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious....

    Published 2025-04-15

    Medium·CVSS 4.8 EPSS 0.28%

    Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and execute arbitrary malicious code.

13. CVE-2025-29281 In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them.

    Published 2025-04-15

    High·CVSS 8.8 EPSS 0.77%

    In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them.

14. CVE-2023-40825 An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list.

    Published 2023-08-28

    High·CVSS 7.2 EPSS 1.2%

    An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list.

15. CVE-2023-30333 An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.

    Published 2023-05-18

    Critical·CVSS 9.8 EPSS 0.94%

    An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file.

16. CVE-2023-29643 Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.

    Published 2023-05-01

    Medium·CVSS 5.4 EPSS 0.46%

    Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.

17. CVE-2023-27757 An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file.

    Published 2023-03-15

    Critical·CVSS 9.8 EPSS 0.94%

    An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.