← Back

Blogengine.net

blogengine.net

Vendor: Dotnetblogengine • 7 CVEs

CVEs (7)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-10721
1Dotnetblogengine
1Blogengine.net
Nov 21, 2024
Jul 3, 2019
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
BlogEngine.NET 3.3.7.0 allows a Client Side URL Redirect via the ReturnUrl parameter, related to BlogEngine/BlogEngine.Core/Services/Security/Security.cs, login.aspx, and register.aspx.
CVE-2019-10717
1Dotnetblogengine
1Blogengine.net
Nov 21, 2024
Jul 3, 2019
N/A· v4
7.1 HIGH· v3
5.5 MEDIUM· v2
BlogEngine.NET 3.3.7.0 allows /api/filemanager Directory Traversal via the path parameter.
CVE-2019-11392
1Dotnetblogengine
1Blogengine.net
Nov 21, 2024
Jun 21, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
BlogEngine.NET 3.3.7 and earlier allows XXE via an apml file to syndication.axd.
CVE-2019-10719
1Dotnetblogengine
1Blogengine.net
Nov 21, 2024
Jun 21, 2019
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exi...Show more
BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution because file creation is mishandled, related to /api/upload and BlogEngine.NET/AppCode/Api/UploadController.cs. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.Show less
CVE-2019-10718
1Dotnetblogengine
1Blogengine.net
Nov 21, 2024
Jun 21, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
BlogEngine.NET 3.3.7.0 and earlier allows XML External Entity Blind Injection, related to pingback.axd and BlogEngine.Core/Web/HttpHandlers/PingbackHandler.cs.
CVE-2013-6953
1Dotnetblogengine
1Blogengine.net
Apr 29, 2026
Jan 3, 2014
N/A· v4
N/A· v3
5.0 MEDIUM· v2
BlogEngine.NET 2.8.0.0 and earlier allows remote attackers to read usernames and password hashes via a request for the sioc.axd file.
CVE-2008-6476
1Dotnetblogengine
1Blogengine.net
Apr 23, 2026
Mar 16, 2009
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in blog/search.aspx in BlogEngine.NET allows remote attackers to inject arbitrary web script or HTML via the q parameter.