Perfree operates a narrowly scoped blogging platform that has accumulated vulnerabilities skewing toward serious outcomes, particularly critical severity. The exposure centers on its Perfreeblog product and recurs through web-application weakness classes including unrestricted file uploads, cross-site scripting, buffer over-reads, improper access control, and code injection—characteristic of an application handling user input and content without sufficient validation or sandboxing. Defenders should treat updates for this platform as consequential when deployed in public-facing or multi-user environments; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Perfree over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-30333CRITICAL An arbitrary file upload vulnerability in the component /admin/ThemeController.java of PerfreeBlog v3.1.2 allows attackers to execute arbitrary code via a crafted file. | May 18, 2023 | 9.8 | 29 | NO | NO |
CVE-2023-27757CRITICAL An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary code via a crafted JPG file. | Mar 15, 2023 | 9.8 | 29 | NO | NO |
CVE-2025-60735HIGH PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function | Oct 24, 2025 | 7.6 | 27 | NO | NO |
CVE-2025-60731HIGH PerfreeBlog v4.0.11 has a File Upload vulnerability in the installTheme function | Oct 24, 2025 | 7.6 | 27 | NO | NO |
CVE-2025-60730HIGH PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function | Oct 24, 2025 | 7.6 | 27 | NO | NO |
CVE-2025-29421HIGH PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function. | Aug 25, 2025 | 7.5 | 25 | NO | NO |
CVE-2025-29420HIGH PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function. | Aug 25, 2025 | 7.5 | 25 | NO | NO |
CVE-2025-29281HIGH In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them. | Apr 15, 2025 | 8.8 | 24 | NO | NO |
CVE-2025-60319MEDIUM PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java). | Oct 30, 2025 | 6.5 | 23 | NO | NO |
CVE-2025-60729MEDIUM PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function | Oct 24, 2025 | 5.3 | 22 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Perfree.
Media articles that mention a CVE ID that affects a product developed by Perfree — matched by CVE ID, not by vendor name.