CVE-2026-51937

HighCVSS 7.5

Published: 07/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and GetAccessTokenComponent.java components.

Risk Assessment

An attacker can capture credentials or access tokens, leading to confidentiality breaches and potential application takeover.

Recommendation

Immediately update Oneblog to the latest version and restrict access to the mentioned components via firewall rules and authentication.

Other vulnerabilities in Oneblog

CVE-2025-56264High
The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability.

Original NVD description (English source)

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component

Vulnerability data from NVD (NIST) · CISA KEV · EPSS