A Blog Cms

a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a legitimate user's session.

Published: 2025-05-19T08:07:38.068Z
Updated: 2025-05-19T15:46:29.408Z

Server-side request forgery vulnerability exists in a-blog cms multiple versions. If this vulnerability is exploited, a remote unauthenticated attacker may gain access to sensitive information by sending a specially crafted request.

Published: 2025-05-19T08:08:00.732Z
Updated: 2025-05-19T15:45:37.691Z

Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product.

Published: 2025-05-19T08:08:51.815Z
Updated: 2025-05-19T15:28:40.444Z

Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.

Published: 2025-03-31T04:54:03.868Z
Updated: 2025-03-31T12:59:20.794Z

Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited, a remote authenticated attacker with the administrator privilege may obtain or delete any file on the server.

Published: 2025-05-19T08:09:26.427Z
Updated: 2025-05-19T14:42:50.286Z