Skip to content
Noroxi

perfree records

14 published records for vendor perfree.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 23
  2. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

14 records
  • CVE-2023-27757
    39Monitor

    An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary co

    CriticalCVSS 9.8No exploitEPSS 0%

    perfree · perfreeblogMar 14, 2023

  • CVE-2023-30333
    39Monitor

    An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitr

    CriticalCVSS 9.8No exploitEPSS 0%

    perfree · perfreeblogMay 18, 2023

  • CVE-2025-29281
    35Monitor

    In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary

    HighCVSS 8.8No exploitEPSS 0%

    perfree · perfreeblogApr 15, 2025

  • CVE-2025-29420
    30Monitor

    PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.

    HighCVSS 7.5No exploitEPSS 0%

    perfree · perfreeblogAug 25, 2025

  • CVE-2025-29421
    30Monitor

    PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.

    HighCVSS 7.5No exploitEPSS 0%

    perfree · perfreeblogAug 25, 2025

  • CVE-2025-60730
    30Monitor

    PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function

    HighCVSS 7.6No exploitEPSS 0%

    perfree · perfreeblogOct 24, 2025

  • CVE-2025-60735
    30Monitor

    PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function

    HighCVSS 7.6No exploitEPSS 0%

    perfree · perfreeblogOct 24, 2025

  • CVE-2025-60731
    30Monitor

    PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function

    HighCVSS 7.6No exploitEPSS 0%

    perfree · perfreeblogOct 24, 2025

  • CVE-2023-40825
    28Monitor

    An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/

    HighCVSS 7.2No exploitEPSS 1%

    perfree · perfreeblogAug 28, 2023

  • CVE-2025-60319
    26Monitor

    PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint

    MediumCVSS 6.5No exploitEPSS 0%

    perfree · perfreeblogOct 30, 2025

  • CVE-2025-5164
    25Monitor

    PerfreeBlog JWT JwtUtil hard-coded key

    MediumCVSS 6.3No exploitEPSS 0%

    perfree · perfreeblogMay 25, 2025

  • CVE-2023-29643
    21Monitor

    Cross Site Scripting (XSS) vulnerability in PerfreeBlog 3.1.2 allows attackers to execute arbitrary code via the Post function.

    MediumCVSS 5.4No exploitEPSS 0%

    perfree · perfreeblogMay 1, 2023

  • CVE-2025-60729
    21Monitor

    PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function

    MediumCVSS 5.3No exploitEPSS 0%

    perfree · perfreeblogOct 24, 2025

  • CVE-2025-29280
    19Monitor

    Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface a

    MediumCVSS 4.8No exploitEPSS 0%

    perfree · perfreeblogApr 15, 2025