Perfree

17 CVEs across 2 Perfree products. Browse Perfree vulnerabilities, severities, and proof-of-concept exploits.

Perfree products with known CVEs

ProductCVEs
Perfreeblog14
Go-Fastdfs-Web3
Perfree CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-11437High7.32026-06-06A flaw has been found in perfree go-fastdfs-web up to 1.3.7. Affected is the function checkServer of the file /install/checkServer of the component Installatio…
CVE-2026-6105High7.32026-04-11A security vulnerability has been detected in perfree go-fastdfs-web up to 1.3.7. This affects an unknown part of the file src/main/java/com/perfree/controller…
CVE-2026-3963Low3.72026-03-11A security flaw has been discovered in perfree go-fastdfs-web up to 1.3.7. This affects the function rememberMeManager of the file src/main/java/com/perfree/co…
CVE-2025-60319Medium6.52025-10-30PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.j…
CVE-2025-60735High7.62025-10-24PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function
CVE-2025-60731High7.62025-10-24PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function
CVE-2025-60730High7.62025-10-24PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function
CVE-2025-60729Medium5.32025-10-24PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function
CVE-2025-29421High7.52025-08-25PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.
CVE-2025-29420High7.52025-08-25PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.
CVE-2025-5164Low3.72025-05-26A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handle…
CVE-2025-29281High8.82025-04-15In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute…
CVE-2025-29280Medium4.82025-04-15Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker t…
CVE-2023-40825High7.22023-08-28An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/list.
CVE-2023-30333Critical9.82023-05-18An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a craf…
CVE-2023-29643Medium5.42023-05-01Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.
CVE-2023-27757Critical9.82023-03-15An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JP…