quequnlong vulnerabilities

Products

• shiyi-blog 9

Latest quequnlong CVEs

Newest publication first

1. CVE-2026-90567 quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting

   Published 2026-09-13

   Medium·CVSS 5.1 EPSS 0.35%

   A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross sit...

2. CVE-2026-90564 quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting

   Published 2026-09-13

   Medium·CVSS 5.1 EPSS 0.35%

   A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/chat/index.vue of the component chat sendMsg Endpoint. Such manipulation of the argument chat_msg leads to cross site scri...

3. CVE-2026-90527 quequnlong shiyi-blog Add Message API index.vue cross site scripting

   Published 2026-09-13

   Medium·CVSS 5.3 EPSS 0.47%

   A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attac...

4. CVE-2025-12305 quequnlong shiyi-blog Job SysJobController.java deserialization

   Published 2025-10-27

   Medium·CVSS 5.3 EPSS 0.51%

   A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobController.java of the component Job Handler. The manipulation results in deserialization. The attack can be executed remotely. T...

5. CVE-2025-5513 quequnlong shiyi-blog add cross site scripting

   Published 2025-06-03

   Medium·CVSS 5.1 EPSS 0.38%

   A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack c...

6. CVE-2025-5512 quequnlong shiyi-blog Administrator Backend verifyPassword improper authentication

   Published 2025-06-03

   Medium·CVSS 6.9 EPSS 0.85%

   A vulnerability, which was classified as critical, was found in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file /api/sys/user/verifyPassword/ of the component Administrator Backend. The manipulation leads to improper authentication. It is possible t...

7. CVE-2025-5511 quequnlong shiyi-blog photos improper authorization

   Published 2025-06-03

   Medium·CVSS 6.9 EPSS 0.80%

   A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1. This issue affects some unknown processing of the file /dev api/app/album/photos/. The manipulation leads to improper authorization. The attack may be initiated remotely. The e...

8. CVE-2025-5510 quequnlong shiyi-blog optimize server-side request forgery

   Published 2025-06-03

   Medium·CVSS 5.3 EPSS 0.50%

   A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. T...

9. CVE-2025-5509 quequnlong shiyi-blog upload path traversal

   Published 2025-06-03

   Medium·CVSS 5.3 EPSS 0.77%

   A vulnerability classified as critical has been found in quequnlong shiyi-blog up to 1.2.1. This affects an unknown part of the file /api/file/upload. The manipulation of the argument file/source leads to path traversal. It is possible to initiate the attack remotely. The exploit...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.