CVE-2026-90567
A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The attack can be initiated remotely. The project was informed of the problem early through an issue report.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
- EPSS probability
- 0.33%
- CWE
- CWE-79, CWE-94
- Published
- 2026-09-13
- Last modified
- 2026-09-15
Affected products
- quequnlong shiyi-blog
- quequnlong shiyi-blog
Weakness type
Related vulnerabilities
- CVE-2026-78252 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2026-90943 — parallax filament-comments through 3.0.0 Stored XSS via Comment Body
- CVE-2026-90561 — Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG
- CVE-2026-89256 — AVideo Bookmark Plugin Stored XSS via Chapter Names
- CVE-2026-89255 — AVideo LoginControl Stored XSS via PGP Public Key
- CVE-2026-89254 — AVideo CustomizeUser Stored XSS via field_name Parameter
- CVE-2026-89253 — AVideo Stored XSS via donationLink in watch page button
- CVE-2026-89249 — AVideo YPTWallet Stored XSS via CryptoWallet Configuration