Cross-Site Scripting Vulnerability in My-Blog-layui 1.0 by ZHENFENG13
CVE-2025-3592
Key Information:
- Vendor
- Zhenfeng13
- Status
- My-blog-layui
- Vendor
- CVE Published:
- 14 April 2025
Badges
Summary
A Cross-Site Scripting vulnerability was identified in My-Blog-layui version 1.0, affecting the /admin/v1/link/edit endpoint. The flaw allows an attacker to exploit multiple parameters, which could potentially be used to execute malicious scripts remotely. This vulnerability has been publicly disclosed and may pose a significant risk to users and applications relying on this product. Despite early notification efforts, the vendor has not provided any response regarding mitigation.
Affected Version(s)
My-Blog-layui 1.0
My-Blog-layui 1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published