Zhyd
Zhyd Oneblog: vulnerabilidades y CVE
Zhyd Oneblog tiene 14 vulnerabilidades publicadas, 1 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses1
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-60355 | Crítica (9.8) | 0.49% | — | 28 oct 2025 | zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. |
| CVE-2025-56264 | Alta (7.5) | 0.40% | — | 16 sept 2025 | The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability. |
| CVE-2025-2835 | Media (5.3) | 0.34% | — | 27 mar 2025 | A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the file com/zyd/blog/controller/RestApiController.java. The… |
| CVE-2025-2833 | Media (6.9) | 0.71% | — | 27 mar 2025 | A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For… |
| CVE-2024-54954 | Alta (8) | 0.45% | — | 10 feb 2025 | OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department. |
| CVE-2024-29474 | Media (5.4) | 0.40% | — | 20 mar 2024 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module. |
| CVE-2024-29473 | Media (6.1) | 0.37% | — | 20 mar 2024 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module. |
| CVE-2024-29472 | Media (5.4) | 0.38% | — | 20 mar 2024 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module. |
| CVE-2024-29471 | Media (5.4) | 0.39% | — | 20 mar 2024 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module. |
| CVE-2024-29470 | Media (6.1) | 0.38% | — | 20 mar 2024 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links. |
| CVE-2024-29469 | Media (6.1) | 0.38% | — | 20 mar 2024 | A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category List parameter under the Lab module. |
| CVE-2022-34013 | Media (4.3) | 0.57% | — | 23 jun 2022 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module. |
| CVE-2022-34012 | Media (6.5) | 0.58% | — | 23 jun 2022 | Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges. |
| CVE-2022-34011 | Media (4.3) | 0.57% | — | 23 jun 2022 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.