CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The |
| 27/03/2025 |
| CVE-2024-54954 | HIGH8.0 | OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department. | 10/02/2025 |
| CVE-2024-29474 | MEDIUM5.4 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module. | 20/03/2024 |
| CVE-2024-29473 | MEDIUM6.1 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module. | 20/03/2024 |
| CVE-2024-29472 | MEDIUM5.4 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module. | 20/03/2024 |
| CVE-2024-29471 | MEDIUM5.4 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module. | 20/03/2024 |
| CVE-2024-29470 | MEDIUM6.1 | OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links. | 20/03/2024 |
| CVE-2024-29469 | MEDIUM6.1 | A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category List parameter under the Lab module. | 20/03/2024 |
| CVE-2022-34013 | MEDIUM4.3 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link module. | 23/06/2022 |
| CVE-2022-34012 | MEDIUM6.5 | Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges. | 23/06/2022 |
| CVE-2022-34011 | MEDIUM4.3 | OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls. | 23/06/2022 |