CVE-2024-28713

An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature.

• CWE-434

• https://gitee.com/mtons/mblogProduct
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%871.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%872.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%873.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%874.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%875.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/Mblog%20blog%20system%20has%20SSTI%20template%20injection%20vulnerability.mdExploit, Third Party Advisory
• https://gitee.com/mtons/mblogProduct
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%871.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%872.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%873.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%874.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%875.pngExploit
• https://github.com/JiangXiaoBaiJia/cve/blob/main/Mblog%20blog%20system%20has%20SSTI%20template%20injection%20vulnerability.mdExploit, Third Party Advisory
• https://www.vicarius.io/vsociety/posts/ssti-in-mblog-351-a-tale-of-a-glorified-rce-cve-2024-28713-28714Exploit, Mitigation, Third Party Advisory

Published

Mar 28, 2024

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28698Directory Traversal vulnerability in Marimer LLC CSLA .Net b…9.8
• CVE-2024-28699A buffer overflow vulnerability in pdf2json v0.70 allows a l…7.8
• CVE-2024-2870The socialdriver-framework WordPress plugin before 2024.04.3…6.1
• CVE-2024-28709Cross Site Scripting vulnerability in LimeSurvey before 6.5.…6.1
• CVE-2024-2871The Media Library Assistant plugin for WordPress is vulnerab…7.7
• CVE-2024-28710Cross Site Scripting vulnerability in LimeSurvey before 6.5.…6.1
• CVE-2024-28714SQL Injection vulnerability in CRMEB_Java e-commerce system …8.1
• CVE-2024-28715Cross Site Scripting vulnerability in DOraCMS v.2.18 and bef…8.8
• CVE-2024-28716An issue in OpenStack Storlets yoga-eom allows a remote atta…7.5
• CVE-2024-28717An issue in OpenStack Storlets yoga-eom allows a remote atta…4.9
• CVE-2024-28718An issue in OpenStack magnum yoga-eom version allows a remot…9.8
• CVE-2024-2872The socialdriver-framework WordPress plugin before 2024.04.3…4.8