CVE-2025-60319

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Oct 30, 2025

CISA due date

—

The record

PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).

Affected packages

Ecosystem	Package	Introduced	Fixed