Afeng2016-So

An issue in Perfree PerfreeBlog allows a remote attacker to execute arbitrary code via a crafted plugin listed in "admin/plugin/access/list".

An issue in pf4j allows a remote attacker to obtain sensitive information and execute arbitrary code via the `zippluginPath` parameter.

A cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `goodsName` parameter in the "/admin/goods/update" API endpoint.

The issue allows for arbitrary file upload via the `Upload` function at the "/admin/goods/edit" API endpoint.

A stored cross-site scripting (XSS) issue in the /admin/contenttemp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

A cross-site scripting (XSS) issue was found in the /TMS/admin/setting/mail/createorupdate component.

The issue is related to insecure permissions in the component "/TMS/admin/user/Update2". This allows attackers to modify the administrator account and password.

The issue allows low-level administrators to delete high-level administrators beyond their authority due to insecure permissions.