EUVD-2026-77044
GHSA-8g7w-hw7q-6jwq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stored XSS requires low-privilege content creation and victim search interaction; scope changes to victim browser; no availability impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The attack can be initiated remotely. The project was informed of the problem early through an issue report.
AnalysisAI
Cross-site scripting in shiyi-blog's search component allows an authenticated attacker to inject malicious scripts via crafted post titles or summaries, which execute in the browsers of other users who trigger search results containing the poisoned content. The highlightKeyword function in blog-web/src/components/Search/index.vue renders the title and summary fields without sanitization, making DOM injection trivial for any low-privilege content creator. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a low-privileged authenticated account on the shiyi-blog instance with permission to create or edit blog posts that populate the `title` or `summary` fields. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, score 5.1 Medium) accurately reflects low-complexity network exploitation with a low-privilege authenticated account required (PR:L) and passive user interaction on the victim's side (UI:P). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today