PT-2025-16342 · Unknown · Perfreeblog

Cray0Nlee · Published 2025-04-15 · Updated 2025-06-24 · CVE-2025-29281

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PerfreeBlog version 4.0.11

Description The issue allows regular users to exploit an arbitrary file upload vulnerability in the attach component, enabling them to upload arbitrary files and execute code within them.

Recommendations For PerfreeBlog version 4.0.11, consider disabling the attach component until a patch is available to prevent exploitation of the arbitrary file upload vulnerability. Restrict access to the attach component to minimize the risk of uploading and executing malicious files.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-29281

Affected Products

Perfreeblog

References · 8

• 🔥 https://github.com/Cray0nLee/CVE/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29281 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29281 · Vendor Advisory
• https://twitter.com/CVEnew/status/1912147858192474203 · Twitter Post
• https://twitter.com/cybercronai/status/1912155325899194454 · Twitter Post
• https://t.me/cvetracker/21638 · Telegram Post
• https://t.me/cvenotify/126513 · Telegram Post
• https://t.me/cvedetector/22979 · Telegram Post