Perfree
3 CVEs across 2 Perfree products. Browse Perfree vulnerabilities, severities, and proof-of-concept exploits.
Perfree products with known CVEs
Perfree CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-11437 | High | 7.3 | 2026-06-06 | A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installatio… |
CVE-2026-6105 | High | 7.3 | 2026-04-11 | A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller… |
CVE-2026-3963 | Low | 3.7 | 2026-03-11 | A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7. This affects the function rememberMeManager of the file src/main/java/com/perfree/co… |
CVE-2025-60319 | Medium | 6.5 | 2025-10-30 | PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.j… |
CVE-2025-60735 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function |
CVE-2025-60731 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function |
CVE-2025-60730 | High | 7.6 | 2025-10-24 | PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function |
CVE-2025-60729 | Medium | 5.3 | 2025-10-24 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function |
CVE-2025-29421 | High | 7.5 | 2025-08-25 | PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function. |
CVE-2025-29420 | High | 7.5 | 2025-08-25 | PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function. |
CVE-2025-5164 | Low | 3.7 | 2025-05-26 | A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handle… |
CVE-2025-29281 | High | 8.8 | 2025-04-15 | In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute… |
CVE-2025-29280 | Medium | 4.8 | 2025-04-15 | Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker t… |
CVE-2023-40825 | High | 7.2 | 2023-08-28 | An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list. |
CVE-2023-30333 | Critical | 9.8 | 2023-05-18 | An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a craf… |
CVE-2023-29643 | Medium | 5.4 | 2023-05-01 | Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function. |
CVE-2023-27757 | Critical | 9.8 | 2023-03-15 | An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JP… |