CVE-2025-2833

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

• CWE-400
• CWE-1333

• https://github.com/zhangyd-c/OneBlog/issues/35Exploit, Issue Tracking
• https://github.com/zhangyd-c/OneBlog/issues/35#issue-2914268214Exploit, Issue Tracking
• https://vuldb.com/?ctiid.301470Permissions Required, VDB Entry
• https://vuldb.com/?id.301470Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.521813Third Party Advisory, VDB Entry
• https://github.com/zhangyd-c/OneBlog/issues/35Exploit, Issue Tracking
• https://github.com/zhangyd-c/OneBlog/issues/35#issue-2914268214Exploit, Issue Tracking

Published

Mar 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2827IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2…4.3
• CVE-2025-2828A Server-Side Request Forgery (SSRF) vulnerability exists in…10
• CVE-2025-2829A local code execution vulnerability exists in the Rockwell …7.8
• CVE-2025-2830By crafting a malformed file name for an attachment in a mul…6.3
• CVE-2025-2831A vulnerability has been found in mingyuefusu 明月复苏 tushuguan…9.8
• CVE-2025-2832A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixit…5.3
• CVE-2025-28343striso-control-firmware 54c9722 is vulnerable to Buffer Over…7.5
• CVE-2025-28344striso-control-firmware 54c9722 is vulnerable to Buffer Over…7.5
• CVE-2025-2835A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. …5.3
• CVE-2025-28354An issue in the Printer Manager Systm of Entrust Corp Printe…6.5
• CVE-2025-28355Volmarg Personal Management System 1.4.65 is vulnerable to C…4.7
• CVE-2025-28357A CRLF injection vulnerability in Neto CMS v6.313.0 through …8.8