CVE-2025-36560: Server-side request forgery vulnerability exists in a-blog cms multiple versions

This month

HIGH 8.6REMOTEUPGRADE

CVE-2025-36560 is a high-severity flaw (CVSS 8.6) affecting a-blog cms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Server-side request forgery vulnerability exists in a-blog cms multiple versions. If this vulnerability is exploited, a remote unauthenticated attacker may gain access to sensitive information by sending a specially crafted request.

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	8.6 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.5% (top 56%)
CISA exploited list	No
Weakness	CWE-918
Published	2025-05-19
Last modified	2026-06-17

Publisher (CNA): JPCERT/CC · Vendor: appleple

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-05-19 09:15 UTCPublished CVE record published
2026-06-17 09:14 UTCUpdated Record last modified

appleple a-blog cms UPGRADE

Affected: >= 2.8.0 and <= 2.8.85 · >= 2.9.0 and <= 2.9.52 · >= 2.10.0 and <= 2.10.63 · >= 2.11.0 and <= 2.11.75 · >= 3.0.0 and <= 3.0.47 · >= 3.1.0 and <= 3.1.43

Fixed in: newer than 3.1.43

Safe to downgrade to: a release before 2.8.0

1. Check installed version

apt-cache policy a-blog-cms || rpm -q a-blog-cms || a-blog-cms --version

2. UPGRADE to newer than 3.1.43 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade a-blog-cms

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade a-blog-cms

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2.8.0 (Debian / Ubuntu)

apt-cache madison a-blog-cms sudo apt install a-blog-cms=<VERSION_BEFORE_2.8.0> sudo apt-mark hold a-blog-cms

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list a-blog-cms sudo dnf downgrade a-blog-cms-<VERSION_BEFORE_2.8.0> sudo dnf versionlock add a-blog-cms

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-36560?

a-blog cms: upgrade to newer than 3.1.43. Exact commands for each OS are on this page.

Is CVE-2025-36560 being exploited?

CVE-2025-36560 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-36560 affect?

CVE-2025-36560 affects a-blog cms. Severity is high (CVSS 8.6). Server-side request forgery vulnerability exists in a-blog cms multiple versions. If this vulnerability is exploited, a remote unauthenticated attacker may gain access to sensitive information by sending a specially crafted request.

How urgent is CVE-2025-36560?

Priority 46/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2025-41429 MEDIUM 4.8 UPGRADE a-blog cms multiple versions neutralize logs improperly
CVE-2025-32999 MEDIUM 5.4 UPGRADE Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver
CVE-2025-31103 HIGH 7.5 UPGRADE Untrusted data deserialization vulnerability exists in a-blog cms
CVE-2025-27566 LOW 3.8 UPGRADE Path traversal vulnerability exists in a-blog cms versions prior to Ver
CVE-2024-31396 MEDIUM 6.6 UPGRADE Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x

References

← Back to latest CVEs