Cross Site Scripting Vulnerability in lenve VBlog by lenve
CVE-2025-2364

3.5LOW

Key Information:

Vendor

lenve

Status
VBlog
Vendor
CVE Published:
17 March 2025

What is CVE-2025-2364?

A cross site scripting vulnerability exists in lenve VBlog versions up to 1.0.0, specifically in the addNewArticle function of ArticleService.java. This vulnerability allows attackers to manipulate the mdContent/htmlContent argument, which can lead to remote exploitation. The issue has been publicly disclosed, raising concerns about its potential abuse. Despite prior contact with the vendor regarding this vulnerability, there has been no response, leaving users exposed to possible attacks.

References

https://magnificent-dill-351.notion.site/Stored-XSS-Vulne...
https://vuldb.com/?ctiid.299863
https://vuldb.com/?id.299863

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.