EUVD-2026-77029
GHSA-8c4x-72fw-q8r4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS executes in admin browser on review; scope changes to victim context enabling session-token theft (C:L) and page tampering (I:L).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Stored cross-site scripting in quequnlong shiyi-blog up to version 1.2.1 allows unauthenticated remote attackers to inject arbitrary JavaScript via the body.content parameter of the Add Message API, which executes in the browser of any administrator who later views submitted messages in the blog-admin panel. The affected file blog-admin/src/views/message/message/index.vue fails to sanitize message body content before rendering it, meaning a crafted submission persists until an admin reviews it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application is running shiyi-blog version 1.2.1 or earlier with the Add Message feature enabled and publicly accessible, which appears to be a default capability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores 5.3, correctly reflecting low attack complexity and no required privileges, but the VC:N metric (no confidentiality impact on the vulnerable system) understates stored XSS risk: script execution in an admin session enables session-token theft and admin credential harvesting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the Gitee disclosure (https://gitee.com/quequnlong/shiyi-blog/issues/IK5RF6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Shiyi Blog
View allA security vulnerability in quequnlong shiyi-blog (CVSS 7.3). Risk factors: public PoC available.
A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part
A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknow
A security vulnerability in quequnlong shiyi-blog (CVSS 5.3). Risk factors: public PoC available.
A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vuln
Remote code execution in Shiyi Blog up to version 1.2.1 allows authenticated remote attackers to execute arbitrary code
Cross-site scripting in shiyi-blog 1.0.0-1.2.1 allows authenticated remote attackers to inject arbitrary JavaScript thro
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today