CVE-2026-90527
Received Received - Intake

Stored XSS in Shiyi-Blog Admin Panel

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90527
EUVD
EUVD-2026-77029

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
quequnlong shiyi-blog to 1.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the shiyi-blog system up to version 1.2.1. An attacker can remotely inject malicious scripts via the body.content parameter in the Add Message API. The malicious content is stored in the database and later rendered unsafely using Vue's v-html in the admin message management page, allowing script execution in the admin's context.

Detection Guidance

To detect this XSS vulnerability, check if your system runs shiyi-blog versions 1.0.0 to 1.2.1. Inspect network traffic for POST requests to /api/message/add with body.content containing script tags or event handlers. Review the message management page source for v-html usage rendering user-provided content.

Impact Analysis

An attacker could steal sensitive admin session cookies, perform actions on behalf of the admin, or deface the blog. Since the attack requires no authentication, any unauthenticated user can exploit it. Admins viewing the message page are at risk of account compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using this software may face compliance violations and potential fines.

Mitigation Strategies

Immediately update to a patched version if available. As a temporary fix, replace v-html with text interpolation in the message management page. Implement input sanitization for body.content before database storage. Add security regression tests to prevent future XSS issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90527. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart