CVE-2026-90564

LOW 3.5

quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scripting

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/chat/index.vue of the component chat sendMsg Endpoint. Such manipulation of the argument chat_msg leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-79 CWE-94
Vendor	quequnlong
Product	shiyi-blog
Published	Sep 13, 2026
Last Updated	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for quequnlong shiyi-blog

Be the first to know when new low vulnerabilities affecting quequnlong shiyi-blog are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

quequnlong / shiyi-blog

1.0.0-1.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/403149 vuldb.com: https://vuldb.com/vuln/403149/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90564 vuldb.com: https://vuldb.com/submit/912553 gitee.com: https://gitee.com/quequnlong/shiyi-blog/issues/IK5RVL gitee.com: https://gitee.com/quequnlong/shiyi-blog/

Credits

🔍 JunRoinxxX (VulDB User) VulDB CNA Team