CVE-2025-5510
Last modified
CVE-2025-5510 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
A vulnerability classified as critical was found in quequnlong shiyi-blog up to 1.2.1. This vulnerability affects unknown code of the file /app/sys/article/optimize. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Quequnlong | Shiyi-Blog | <= 1.2.1 |
References
- https://vuldb.com/?ctiid.310924Permissions Required, VDB Entry
- https://vuldb.com/?id.310924Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.584489Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-5510?
How severe is CVE-2025-5510?
How do I fix CVE-2025-5510?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-55094In NetX Duo before 6.4.4, the networking support module for …7.5
- CVE-2025-55095The function _ux_host_class_storage_media_mount() is respons…7
- CVE-2025-55096In USBX before 6.4.3, the USB support module for Eclipse Fou…6.1
- CVE-2025-55097In USBX before 6.4.3, the USB support module for Eclipse Fou…6.1
- CVE-2025-55098In USBX before 6.4.3, the USB support module for Eclipse Fou…6.1
- CVE-2025-55099In USBX before 6.4.3, the USB support module for Eclipse Fou…6.1
- CVE-2025-55100In USBX before 6.4.3, the USB support module for Eclipse Fou…9.1
- CVE-2025-55102A denial-of-service vulnerability exists in the NetX IPv6 co…7.5
- CVE-2025-55103There is a stored Cross-site Scripting vulnerability in Esri…4.8
- CVE-2025-55104A stored cross-site scripting (XSS) vulnerability exists Arc…4.8
- CVE-2025-55105There is a stored Cross-site Scripting vulnerability in Esri…4.8
- CVE-2025-55106There is a stored Cross-site Scripting vulnerability in Esri…4.8
Are you affected by CVE-2025-5510?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST