CVE-2026-90527: fallo de gravedad media en quequnlong shiyi-blog
quequnlong shiyi-blog Add Message API index.vue cross site scripting
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.5%
A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
Productos afectados
quequnlong · shiyi-blogCVEs relacionadas — quequnlong shiyi-blog
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-5512MEDIUMquequnlong shiyi-blog Administrator Backend verifyPassword improper authenticationEPSS 0.8%CVE-2025-5511MEDIUMquequnlong shiyi-blog photos improper authorizationEPSS 0.8%CVE-2025-5509MEDIUMquequnlong shiyi-blog upload path traversalEPSS 0.8%CVE-2025-12305MEDIUMquequnlong shiyi-blog Job SysJobController.java deserializationEPSS 0.5%CVE-2025-5510MEDIUMquequnlong shiyi-blog optimize server-side request forgeryEPSS 0.5%CVE-2025-5513MEDIUMquequnlong shiyi-blog add cross site scriptingEPSS 0.4%