Is there a public PoC exploit available for CVE-2025-12305?

Yes, a public proof-of-concept exploit is available for CVE-2025-12305. Prioritise patching immediately. EPSS: 0.1%.

Shiyi Blog CVE-2025-12305

Q: What is the CVSS score of CVE-2025-12305?

CVE-2025-12305 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Input Validation (CWE-20)

2025-10-27 cna@vuldb.com

Java Deserialization Shiyi Blog

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:33 vuln.today

DescriptionCVE.org

A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobController.java of the component Job Handler. The manipulation results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used.

AnalysisAI

Remote code execution in Shiyi Blog up to version 1.2.1 allows authenticated remote attackers to execute arbitrary code via unsafe deserialization in the Job Handler component (SysJobController.java). The CVSS score of 2.1 reflects required authenticated access and limited scope, but the combination of public exploit availability, demonstrated deserialization flaw, and network accessibility creates moderate operational risk despite the low severity rating.

Technical ContextAI

The vulnerability exists in the Job Handler component within src/main/java/com/mojian/controller/SysJobController.java of the Shiyi Blog application, a Java-based blogging platform. The root cause is classified as CWE-20 (Improper Input Validation), manifesting as unsafe deserialization of untrusted data. Java deserialization vulnerabilities occur when an application deserializes data from an untrusted source without proper validation, allowing attackers to instantiate arbitrary classes and trigger code execution through gadget chains available in the application's classpath. The vulnerability is remotely accessible via the HTTP interface, making it exploitable from the network boundary.

RemediationAI

Immediate action: Upgrade Shiyi Blog to a patched version if available from the vendor at https://github.com/quequnlong/shiyi-blog. If no newer version is available, restrict access to the Job Handler endpoint (/job or similar paths, depending on routing configuration) to trusted administrators only using network-level controls (firewall rules, reverse proxy authentication). Apply input validation and deserialization safeguards: disable automatic deserialization if possible, or implement a whitelist of allowed classes for deserialization. Review authentication policies to ensure only necessary administrators have access to job management features. Monitor application logs for suspicious deserialization errors or job handler invocations. Consider isolating Shiyi Blog instances from the public internet if not required for external access, reducing the attack surface to internal networks where authentication controls are stronger.