Critical severity · published Mar 28, 2024
CVE-2024-28713
An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MB
Mblog · Mtons
3.5.0 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28713
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28713
Product
https://gitee.com/mtons/mblog
Exploit
https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%871.png
Exploit
https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%872.png
Exploit
https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%873.png
Exploit
https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%874.png
Exploit
https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%875.png
More from Mblog
9.1
CVE-2025-9004
mtons mblog password excessive authentication
6.5
CVE-2025-8992
mtons mblog cross-site request forgery
6.1
CVE-2025-9647
mtons mblog list cross site scripting
6.1
CVE-2025-9433
mtons mblog Admin Panel list cross site scripting
6.1
CVE-2025-9432
mtons mblog Admin Panel list cross site scripting