Approved changes feed: RSS · Atom
cpe:2.3:a:zhyd:oneblog:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Zhyd (df6214ea-bec4-57a8-83c1-050990c93250) |
|---|---|
| Product | Oneblog (6c17ae10-333f-57fa-9cc2-e7bc8f8f2902) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/zhangyd-c/oneblog |
purl2cpe | 2026-06-01 10:16:19.573689 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-60355 |
vulnerable | 2026-06-08 07:37:26.894818 |
Details available
zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
Published: 2025-10-28T00:00:00.000Z
Updated: 2026-03-04T18:05:34.071Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2835 |
vulnerable | 2026-06-08 07:16:58.454576 |
zhangyd-c OneBlog RestApiController.java autoLink server-side request forgery
MEDIUM (4.3)
A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Published: 2025-03-27T04:00:07.721Z
Updated: 2025-03-27T13:40:16.293Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2833 |
vulnerable | 2026-06-08 07:16:58.454049 |
zhangyd-c OneBlog HTTP Header redos
MEDIUM (5.3)
A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Published: 2025-03-27T04:00:05.554Z
Updated: 2025-03-27T13:41:47.915Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-54954 |
vulnerable | 2026-06-08 06:54:16.875360 |
Details available
OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.
Published: 2025-02-10T00:00:00.000Z
Updated: 2025-02-26T18:33:58.706Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.