BlogEngine/BlogEngine.NET

BlogEngine/BlogEngine.NET

Releases4

Frequency10 months 4 weeks

Last Release almost 7 years ago

Stars990

Multi-User ASP.NET Blogging Application

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2022-41417 ↗	Jan 18, 2023Wednesday, 18 January 2023, 14:15	9.8 CRITICAL	—
BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.
CVE-2022-41418 ↗	Dec 19, 2022Monday, 19 December 2022, 20:15	7.2 HIGH	—
An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVE-2022-36600 ↗	Sep 2, 2022Friday, 2 September 2022, 05:15	4.8 MEDIUM	—
BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.
CVE-2019-10717 ↗	Jul 3, 2019Wednesday, 3 July 2019, 16:15	—	5.5 MEDIUM
BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.
CVE-2019-10721 ↗	Jul 3, 2019Wednesday, 3 July 2019, 16:15	—	5.8 MEDIUM
BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx.
CVE-2018-14485 ↗	May 7, 2019Tuesday, 7 May 2019, 18:29	—	7.5 HIGH
BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd.
CVE-2019-6714 ↗	Mar 21, 2019Thursday, 21 March 2019, 16:01	—	7.5 HIGH
An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user.