CVE-2025-60355

< 2.3.9

zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

9.8CRITICAL

CVE-2025-56264

all versions

The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability.

7.5HIGH

CVE-2025-2835

<= 2.3.9

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is

4.3MEDIUM

CVE-2025-2833

<= 2.3.9

A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function

5.3MEDIUM

CVE-2024-54954

<= 2.3.6

OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.

8.0HIGH

CVE-2024-29474

all versions

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module.

5.4MEDIUM

CVE-2024-29473

all versions

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module.

6.1MEDIUM

CVE-2024-29472

all versions

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module.

5.4MEDIUM

CVE-2024-29471

all versions

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module.

5.4MEDIUM

CVE-2024-29470

all versions

OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links.

6.1MEDIUM

CVE-2024-29469

all versions

A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via

6.1MEDIUM

CVE-2022-34013

all versions

OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Logo parameter under the Link

4.3MEDIUM

CVE-2022-34012

all versions

Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hol

6.5MEDIUM

CVE-2022-34011

all versions

OneBlog v2.3.4 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the parameter entryUrls.

4.3MEDIUM

CVE-2021-46085

<= 2.2.8

OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their

6.5MEDIUM

CVE-2021-46025

<= 2.2.8

A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the backg

5.4MEDIUM