CVE-2025-31103

Untrusted data deserialization vulnerability exists in a-blog cms. Processing a specially crafted request may store arbitrary files on the server where the product is running. This can be leveraged to execute an arbitrary script on the server.

• CWE-502

• https://developer.a-blogcms.jp/blog/news/entry-4197.htmlVendor Advisory
• https://developer.a-blogcms.jp/blog/news/security-update202503.htmlVendor Advisory
• https://jvn.jp/en/jp/JVN66982699/Third Party Advisory

Published

Mar 31, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-31098Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2025-31099Improper Neutralization of Special Elements used in an SQL C…7.6
• CVE-2025-3110OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-…7.5
• CVE-2025-31100Unrestricted Upload of File with Dangerous Type vulnerabilit…9.9
• CVE-2025-31101Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2025-31102Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-31104An Improper Neutralization of Special Elements used in an OS…7.2
• CVE-2025-31105Rejected reason: Not used
• CVE-2025-31106Rejected reason: Not used
• CVE-2025-31107Rejected reason: Not used
• CVE-2025-31108Rejected reason: Not used
• CVE-2025-31109Rejected reason: Not used