Priority HIGH 82
zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00527 · Published 2025-10-28 · No fix listed CWE-1336
Priority HIGH 72
The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00403 · Published 2025-09-16 · No fix listed CWE-400
Priority MEDIUM 57
A vulnerability was found in zhangyd-c OneBlog up to 2.3.9.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00351 · Published 2025-03-27 · No fix listed CWE-918
Priority HIGH 70
A vulnerability was found in zhangyd-c OneBlog up to 2.3.9.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00729 · Published 2025-03-27 · No fix listed CWE-1333
Priority HIGH 70
OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.00448 · Published 2025-02-10 · No fix listed CWE-1336
Priority MEDIUM 58
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.004 · Published 2024-03-20 · No fix listed CWE-79
Priority LOW 27
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00367 · Published 2024-03-20 · No fix listed CWE-79
Priority LOW 25
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00379 · Published 2024-03-20 · No fix listed CWE-79
Priority MEDIUM 58
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00387 · Published 2024-03-20 · No fix listed CWE-79
Priority LOW 27
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00375 · Published 2024-03-20 · No fix listed CWE-79
Priority MEDIUM 60
A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category List parameter under the Lab module.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00375 · Published 2024-03-20 · No fix listed CWE-79
Priority LOW 21
OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00568 · Published 2022-06-23 · No fix listed CWE-918
Priority LOW 30
Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00577 · Published 2022-06-23 · No fix listed CWE-732
Priority LOW 21
OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00568 · Published 2022-06-23 · No fix listed CWE-918
THREATIST.IORead the docs