Skip to main content

Shiyi Blog EUVDEUVD-2025-16765

| CVE-2025-5513 LOW
Cross-site Scripting (XSS) (CWE-79)
2025-06-03 cna@vuldb.com
XSS Shiyi Blog Quequnlong
3.5
CVSS 3.1 · NVD

Severity by source

NVD PRIMARY
3.5 LOW
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

4
EUVD ID Assigned
Mar 14, 2026 - 17:04 euvd
EUVD-2025-16765
Analysis Generated
Mar 14, 2026 - 17:04 vuln.today
PoC Detected
Oct 03, 2025 - 01:07 vuln.today
Public exploit code
CVE Published
Jun 03, 2025 - 18:15 nvd
LOW 3.5

DescriptionCVE.org

A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

More in Shiyi Blog

View all
CVE-2025-5512 HIGH POC
7.3 Jun 03

A security vulnerability in quequnlong shiyi-blog (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-5509 MEDIUM POC
6.3 Jun 03

A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part
CVE-2025-5510 MEDIUM POC
6.3 Jun 03

A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknow
CVE-2025-5511 MEDIUM POC
5.3 Jun 03

A security vulnerability in quequnlong shiyi-blog (CVSS 5.3). Risk factors: public PoC available.
CVE-2025-12305 LOW POC
2.1 Oct 27

Remote code execution in Shiyi Blog up to version 1.2.1 allows authenticated remote attackers to execute arbitrary code

CVE-2026-90527 MEDIUM
5.3 Sep 13

Stored cross-site scripting in quequnlong shiyi-blog up to version 1.2.1 allows unauthenticated remote attackers to inje
CVE-2026-90564 MEDIUM
5.1 Sep 13

Cross-site scripting in shiyi-blog 1.0.0-1.2.1 allows authenticated remote attackers to inject arbitrary JavaScript thro

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2025-16765 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy