CVE-2026-90567: fallo de gravedad media en quequnlong shiyi-blog
quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.3%
A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The attack can be initiated remotely. The project was informed of the problem early through an issue report.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
Productos afectados
quequnlong · shiyi-blogCVEs relacionadas — quequnlong shiyi-blog
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-5512MEDIUMquequnlong shiyi-blog Administrator Backend verifyPassword improper authenticationEPSS 0.8%CVE-2025-5511MEDIUMquequnlong shiyi-blog photos improper authorizationEPSS 0.8%CVE-2025-5509MEDIUMquequnlong shiyi-blog upload path traversalEPSS 0.8%CVE-2025-12305MEDIUMquequnlong shiyi-blog Job SysJobController.java deserializationEPSS 0.5%CVE-2025-5510MEDIUMquequnlong shiyi-blog optimize server-side request forgeryEPSS 0.5%CVE-2026-90527MEDIUMquequnlong shiyi-blog Add Message API index.vue cross site scriptingEPSS 0.5%