CVE-2025-5513

Name of the Vulnerable Software and Affected Versions quequnlong shiyi-blog versions up to 1.2.1

Description A vulnerability has been found in quequnlong shiyi-blog, affecting an unknown functionality of the file "/dev-api/api/comment/add". The manipulation of the content argument leads to cross-site scripting. The attack can be launched remotely.

Recommendations For quequnlong shiyi-blog versions up to 1.2.1, as a temporary workaround, consider restricting access to the "/dev-api/api/comment/add" endpoint until a patch is available. Avoid using the content argument in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.