https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-33404.htmlhttps://patchthecve.com/cve/CVE-2023-33404.htmlWed, 17 Jun 2026 06:01:41 +0000CRITICAL 9.8: An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code.https://patchthecve.com/cve/CVE-2023-33405.htmlhttps://patchthecve.com/cve/CVE-2023-33405.htmlWed, 17 Jun 2026 06:01:42 +0000MEDIUM 6.1: Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.https://patchthecve.com/cve/CVE-2023-22858.htmlhttps://patchthecve.com/cve/CVE-2023-22858.htmlWed, 17 Jun 2026 05:36:18 +0000MEDIUM 5.3: An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.https://patchthecve.com/cve/CVE-2023-22857.htmlhttps://patchthecve.com/cve/CVE-2023-22857.htmlWed, 17 Jun 2026 05:36:18 +0000HIGH 8.5: A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post.https://patchthecve.com/cve/CVE-2023-22856.htmlhttps://patchthecve.com/cve/CVE-2023-22856.htmlWed, 17 Jun 2026 05:36:18 +0000HIGH 8.5: A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file.https://patchthecve.com/cve/CVE-2022-41417.htmlhttps://patchthecve.com/cve/CVE-2022-41417.htmlWed, 17 Jun 2026 05:03:10 +0000CRITICAL 9.8: BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.https://patchthecve.com/cve/CVE-2022-41418.htmlhttps://patchthecve.com/cve/CVE-2022-41418.htmlWed, 17 Jun 2026 05:03:10 +0000HIGH 7.2: An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.https://patchthecve.com/cve/CVE-2022-36600.htmlhttps://patchthecve.com/cve/CVE-2022-36600.htmlWed, 17 Jun 2026 04:53:44 +0000MEDIUM 4.8: BlogEngine v3.3.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /blogengine/api/posts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field.https://patchthecve.com/cve/CVE-2022-28921.htmlhttps://patchthecve.com/cve/CVE-2022-28921.htmlWed, 17 Jun 2026 04:39:19 +0000MEDIUM 6.5: A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server.https://patchthecve.com/cve/CVE-2022-25591.htmlhttps://patchthecve.com/cve/CVE-2022-25591.htmlWed, 17 Jun 2026 04:33:43 +0000CRITICAL 9.1: BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request.