High · 7.5 CVE-2026-51937 EUVD-2026-42158GHSA-mmvx-rq8p-h6g9

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.ja…

Published Jul 7, 2026 · Updated Jul 8, 2026 · Assigned by mitre

Description

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component

References

https://developers.weixin.qq.com/doc/offiaccount/Basic_Information/Get_access_token.html
https://github.com/zhangyd-c/OneBlog/issues/43
https://gist.github.com/Passwords404/2599df955cdb36b36b9551b5b7809114