What’s Vulnerable › Vulnerabilities

CVE-2025-31103

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-31 · updated 2026-06-17
• Weakness: CWE-502

Description

Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.

Affected products

• appleple inc. a-blog cms: through 2.8.80; from 2.9.0 through 2.9.46; from 2.10.0 before 2.10.58; from 2.11.0 before 2.11.70; from 3.0.0 before 3.0.41; from 3.1.0 before 3.1.37 — fixed in 2.10.58, 2.11.70, 3.0.41, 3.1.37

How to fix

Upgrade to a fixed version: appleple inc. a-blog cms 2.10.58, 2.11.70, 3.0.41, 3.1.37. Check the vendor advisory for mitigations.

References

• https://developer.a-blogcms.jp/blog/news/entry-4197.html
• https://developer.a-blogcms.jp/blog/news/security-update202503.html
• https://jvn.jp/en/jp/JVN66982699/

Get alerted when CVE-2025-31103 or the next vulnerability affects your stack