CVE-2025-5164

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-5164

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5164.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-5164

Published

2025-05-26T02:00:06.318Z

Modified

2026-07-15T01:49:18.023285065Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

PerfreeBlog JWT JwtUtil hard-coded key

Details

A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handler. The manipulation leads to use of hard-coded cryptographic key . The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cwe_ids": [
        "CWE-320",
        "CWE-321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5164.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.0.11"
                },
                {
                    "last_affected": "4.0.11"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/perfreeblog/perfreeblog

Affected ranges

Type

GIT

Repo

https://github.com/perfreeblog/perfreeblog

Events

Introduced

12ba053502aa156ba957624e54f76e6cd9d6d4f9

Last affected

12ba053502aa156ba957624e54f76e6cd9d6d4f9

Database specific

{
    "cpe": "cpe:2.3:a:perfree:perfreeblog:4.0.11:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.0.11"
        },
        {
            "last_affected": "4.0.11"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

4.*

4.0.11

v4.*

v4.0.11

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-5164.json"