CVE-2025-5511

A vulnerability, which was classified as critical, has been found in quequnlong shiyi-blog up to 1.2.1. This issue affects some unknown processing of the file /dev api/app/album/photos/. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-266
• CWE-285

• https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.mdExploit, Third Party Advisory
• https://github.com/uglory-gll/javasec/blob/main/shiyi-blog.md#31bypass-password-verification-and-directly-view-photo-albumsExploit, Third Party Advisory
• https://vuldb.com/?ctiid.310925Permissions Required, VDB Entry
• https://vuldb.com/?id.310925Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.584490Third Party Advisory, VDB Entry

Published

Jun 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55104A stored cross-site scripting (XSS) vulnerability exists Arc…4.8
• CVE-2025-55105There is a stored Cross-site Scripting vulnerability in Esri…4.8
• CVE-2025-55106There is a stored Cross-site Scripting vulnerability in Esri…4.8
• CVE-2025-55107There is a stored Cross-site Scripting vulnerability in Es…4.8
• CVE-2025-55108The Control-M/Agent is vulnerable to unauthenticated remote …10
• CVE-2025-55109An authentication bypass vulnerability exists in the out-of-…9.5
• CVE-2025-55110Control-M/Agents use a kdb or PKCS#12 keystore by default, a…5.7
• CVE-2025-55111Certain files with overly permissive permissions were identi…5.7
• CVE-2025-55112Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (an…7.6
• CVE-2025-55113If the Access Control List is enforced by the Control-M/Agen…10
• CVE-2025-55114The improper order of AUTHORIZED_CTM_IP validation in the Co…6.9
• CVE-2025-55115A path traversal in the Control-M/Agent can lead to a local …9.3