CVE-2025-31103

published 2025-03-31

CVE-2025-31103: Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the…

Priority P2 79 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I H A N

ITW VulnCheck KEV

Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
appleple	a-blog_cms	<= 2.8.80	—
appleple	a-blog_cms	>= 2.10.0 < 2.10.58	2.10.58
appleple	a-blog_cms	>= 2.11.0 < 2.11.70	2.11.70
appleple	a-blog_cms	2.9.0 – 2.9.46	—
appleple	a-blog_cms	>= 3.0.0 < 3.0.41	3.0.41
appleple	a-blog_cms	>= 3.1.0 < 3.1.37	3.1.37
appleple_inc	a-blog_cms	—	—
appleple_inc	a-blog_cms	—	—
appleple_inc	a-blog_cms	—	—
appleple_inc	a-blog_cms	—	—
appleple_inc	a-blog_cms	—	—
appleple_inc	a-blog_cms	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vulncheck 7.5 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-502