Quequnlong
Monthly
Cross-site scripting in shiyi-blog 1.0.0-1.2.1 allows authenticated remote attackers to inject arbitrary JavaScript through the `chat_msg` argument of the chat sendMsg endpoint, with execution triggered when another user loads the chat history via `SysChatMsgMapper.getChatMsgList`. The vulnerability resides in the Vue.js frontend component `blog-web/src/views/chat/index.vue` due to improper output encoding of user-supplied chat content. No vendor patch is available; the project has not responded to the responsible disclosure filed on Gitee.
Stored cross-site scripting in quequnlong shiyi-blog up to version 1.2.1 allows unauthenticated remote attackers to inject arbitrary JavaScript via the body.content parameter of the Add Message API, which executes in the browser of any administrator who later views submitted messages in the blog-admin panel. The affected file blog-admin/src/views/message/message/index.vue fails to sanitize message body content before rendering it, meaning a crafted submission persists until an admin reviews it. No vendor patch exists - the maintainer has not responded to the Gitee issue report (IK5RF6), and no public exploit has been identified at time of analysis.
Remote code execution in Shiyi Blog up to version 1.2.1 allows authenticated remote attackers to execute arbitrary code via unsafe deserialization in the Job Handler component (SysJobController.java). The CVSS score of 2.1 reflects required authenticated access and limited scope, but the combination of public exploit availability, demonstrated deserialization flaw, and network accessibility creates moderate operational risk despite the low severity rating.
A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability in quequnlong shiyi-blog (CVSS 7.3). Risk factors: public PoC available.
A security vulnerability in quequnlong shiyi-blog (CVSS 5.3). Risk factors: public PoC available.
A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part of the file /api/file/upload. The manipulation of the argument file/source leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Cross-site scripting in shiyi-blog 1.0.0-1.2.1 allows authenticated remote attackers to inject arbitrary JavaScript through the `chat_msg` argument of the chat sendMsg endpoint, with execution triggered when another user loads the chat history via `SysChatMsgMapper.getChatMsgList`. The vulnerability resides in the Vue.js frontend component `blog-web/src/views/chat/index.vue` due to improper output encoding of user-supplied chat content. No vendor patch is available; the project has not responded to the responsible disclosure filed on Gitee.
Stored cross-site scripting in quequnlong shiyi-blog up to version 1.2.1 allows unauthenticated remote attackers to inject arbitrary JavaScript via the body.content parameter of the Add Message API, which executes in the browser of any administrator who later views submitted messages in the blog-admin panel. The affected file blog-admin/src/views/message/message/index.vue fails to sanitize message body content before rendering it, meaning a crafted submission persists until an admin reviews it. No vendor patch exists - the maintainer has not responded to the Gitee issue report (IK5RF6), and no public exploit has been identified at time of analysis.
Remote code execution in Shiyi Blog up to version 1.2.1 allows authenticated remote attackers to execute arbitrary code via unsafe deserialization in the Job Handler component (SysJobController.java). The CVSS score of 2.1 reflects required authenticated access and limited scope, but the combination of public exploit availability, demonstrated deserialization flaw, and network accessibility creates moderate operational risk despite the low severity rating.
A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security vulnerability in quequnlong shiyi-blog (CVSS 7.3). Risk factors: public PoC available.
A security vulnerability in quequnlong shiyi-blog (CVSS 5.3). Risk factors: public PoC available.
A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part of the file /api/file/upload. The manipulation of the argument file/source leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.