Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-90567— quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting

Quick assessment

Affected

quequnlong shiyi-blog

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 kequnlong shiyi-blog 1.2.1 及之前版本中发现一个安全漏洞。受影响的组件是中位于文件中的函数。通过对 / 参数的操纵，可引发跨站脚本（XSS）攻击。该攻击可远程发起。项目方已通过问题报告较早地获知了该问题。

CVSS 3.5 · Low Updated Sep 14, 2026

Possible ATT&CK Techniques 1 AI

T1189 · Drive-by Compromise

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting

Source: CVE Program / CVE List V5

Vulnerability Description

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The attack can be initiated remotely. The project was informed of the problem early through an issue report.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
quequnlong	shiyi-blog	1.2.0	`cpe:2.3:a:quequnlong:shiyi-blog::::::::`

II. Public POCs for CVE-2026-90567

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-90567

请登录查看更多情报信息。

Vendor Pages for CVE-2026-90567 (1)

🔗 拾壹博客: 一款vue+springboot前后端分离的博客系统，博客后台管理系统使用了vue+elmentui开发，后端使用Sa-Token进行权限管理,支持动态菜单权限，动态定时任务，文件支持本地和S3协议上传，使用ElasticSearch作为全文检索服务，支持QQ、微信公众号扫码、码云、GitHub登录。实现即时通讯聊天室功能 product

Other References for CVE-2026-90567 (4)

https://gitee.com/quequnlong/shiyi-blog/issues/IK5SPD issue-tracking
https://vuldb.com/cve/CVE-2026-90567 third-party-advisory
https://vuldb.com/vuln/403152/cti signature permissions-required
https://vuldb.com/submit/912671 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-90567

Same Patch Batch · quequnlong · 2026-09-13 · 3 CVEs total

CVE-2026-90527	4.3 MEDIUM	quequnlong shiyi-blog Add Message API index.vue cross site scripting
CVE-2026-90564	3.5 LOW	quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cros

IV. Related Vulnerabilities

Same product: shiyi-blog

Same vendor: quequnlong

Same weakness: CWE-79

V. Comments for CVE-2026-90567

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-90567— quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-90567

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-90567

III. Intelligence Information for CVE-2026-90567

Vendor Pages for CVE-2026-90567 (1)

Other References for CVE-2026-90567 (4)

Same Patch Batch · quequnlong · 2026-09-13 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-90567

Leave a comment