Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product.

Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product.

a-blog cms provided by appleple inc. contains multiple vulnerabilities listed below. <ul> <li>Path traversal (CWE-22)</li> <ul> <li>CVE-2025-27566</li> <li>This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege</li> </ul> <li>Cross-site scripting (CWE-79)</li> <ul> <li>CVE-2025-32999</li> <li>This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges</li> </ul> <li>Server-side request forgery (CWE-918)</li> <ul><li>CVE-2025-36560</li></ul> <li>Improper output neutralization for logs (CWE-117)</li> <ul><li>CVE-2025-41429</li></ul> CVE-2025-27566, CVE-2025-32999 haidv35 (Dinh Viet Hai) reported these vulnerabilities to the developer and coordinated. After the coordination was completed, haidv35 (Dinh Viet Hai) reported the case to JPCERT/CC to notify users of the solution through JVN. CVE-2025-36560, CVE-2025-41429 vcth4nh from VCSLab of Viettel Cyber Security (Vu Chi Thanh) reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.