CVE-2024-28713

CriticalCVSS 9.8

Published: 28/03/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.34%

68th percentile - higher than 68% of all known CVEs

Summary

An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file uploaded to the theme management feature.

Risk Assessment

An attacker can take over the server, steal data, or install malware, posing a critical threat to the confidentiality, integrity, and availability of the system.

Recommendation

Immediately update Mblog to the latest available version and restrict file upload permissions in the theme management feature.

Original NVD description (English source)

An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature.