CVE-2025-5512

Name of the Vulnerable Software and Affected Versions quequnlong shiyi-blog versions up to 1.2.1

Description A critical issue was found in the Administrator Backend component, specifically in the /api/sys/user/verifyPassword/ endpoint, affecting an unknown function. This leads to improper authentication and can be exploited remotely. The issue has been publicly disclosed.

Recommendations For quequnlong shiyi-blog versions up to 1.2.1, as a temporary workaround, consider restricting access to the /api/sys/user/verifyPassword/ endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.