CVE-2025-60735

HIGH

PerfreeBlog 4.0.11 - Arbitrary File Upload via installPlugin Function

Title source: llm

PerfreeBlog v4.0.11 has a File Upload vulnerability in the installPlugin function

Core 3

Core References

Broken Link

Broken Link

Product

CVSS v3 7.6

EPSS 0.0025

EPSS Percentile 16.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

CWE

CWE-434

Status published

Products (1)

perfree/perfreeblog 4.0.11

Published Oct 24, 2025

Tracked Since Feb 18, 2026