Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-90527

quequnlong shiyi-blog Add Message API index.vue cross site scripting

CVSS 4.0 5.3 MEDIUMCVSS 3.1 4.3 MEDIUMCVSS 3.0 4.3 MEDIUMCVSS 2.0 5.0 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-90527

Published

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-90527

Published

shiyi-blog

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "quequnlong",
                    "product": "shiyi-blog",
                    "versions": [
                        {
                            "version": "1.2.0",
                            "status": "affected"
                        },
                        {
                            "version": "1.2.1",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:quequnlong:shiyi-blog:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Add Message API"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON