a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a legitimate user's session.

a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a legitimate user's session.

a-blog cms provided by appleple inc. contains multiple vulnerabilities listed below. <ul> <li>Path traversal (CWE-22)</li> <ul> <li>CVE-2025-27566</li> <li>This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege</li> </ul> <li>Cross-site scripting (CWE-79)</li> <ul> <li>CVE-2025-32999</li> <li>This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges</li> </ul> <li>Server-side request forgery (CWE-918)</li> <ul><li>CVE-2025-36560</li></ul> <li>Improper output neutralization for logs (CWE-117)</li> <ul><li>CVE-2025-41429</li></ul> CVE-2025-27566, CVE-2025-32999 haidv35 (Dinh Viet Hai) reported these vulnerabilities to the developer and coordinated. After the coordination was completed, haidv35 (Dinh Viet Hai) reported the case to JPCERT/CC to notify users of the solution through JVN. CVE-2025-36560, CVE-2025-41429 vcth4nh from VCSLab of Viettel Cyber Security (Vu Chi Thanh) reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.