Forestblog Project develops a focused blogging platform whose vulnerability profile skews toward serious outcomes, with a notable share of disclosures reaching critical severity. The recurring exposure centers on the core Forestblog product and clusters around application-layer weaknesses—cross-site scripting, code injection, unrestricted file uploads, and cross-site request forgery—that are typical of web-facing content-management systems and reflect input-handling and session-management demands in permissive publishing contexts. Current severity, exploitation activity, and CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Forestblog Project over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-18964HIGH Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privileges. | May 11, 2021 | 8.8 | 26 | NO | NO |
CVE-2023-6887CRITICAL A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630. This affects an unknown part of the file /admin/upload/img of the component Image Upload | Dec 17, 2023 | 9.8 | 24 | NO | NO |
CVE-2021-46033CRITICAL In ForestBlog, as of 2021-12-28, File upload can bypass verification. | Jan 25, 2022 | 9.8 | 24 | NO | NO |
CVE-2022-29020MEDIUM ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar. | Apr 16, 2022 | 6.1 | 22 | NO | NO |
CVE-2021-46034MEDIUM A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box. | Jan 25, 2022 | 6.1 | 21 | NO | NO |
CVE-2025-3005MEDIUM A vulnerability was found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this issue is some unknown functionality of the component Friend Link Handl | Mar 31, 2025 | 5.4 | 17 | NO | NO |
CVE-2025-3004MEDIUM A vulnerability has been found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /search. Th | Mar 31, 2025 | 5.4 | 17 | NO | NO |
CVE-2024-57498MEDIUM Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing function. | Feb 3, 2025 | 4.8 | 15 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Forestblog Project.
Media articles that mention a CVE ID that affects a product developed by Forestblog Project — matched by CVE ID, not by vendor name.