Vulnerability · Published Oct 27, 2025 · Assigned by VulDB
CVE-2025-12305quequnlong shiyi-blog Job SysJobController.java deserialization
Medium 6.3
In plain English
A medium-severity unsafe deserialization in shiyi-blog from quequnlong. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.5%top 56.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in quequnlong shiyi-blog up to 1.2.1. This impacts an unknown function of the file src/main/java/com/mojian/controller/SysJobController.java of the component Job Handler. The manipulation results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| quequnlong | shiyi-blog | 1.2.01.2.1 |
Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-329977 | quequnlong shiyi-blog Job SysJobController.java deserialization vdb-entry
- VDB-329977 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #676725 | https://gitee.com/quequnlong/shiyi-blog shiyi-blog 1.2.1 Deserialization of Untrusted Data third-party-advisory
- Submit #676730 | https://gitee.com/quequnlong/shiyi-blog shiyi-blog 1.2.1 Command Injection (Duplicate) third-party-advisory
- https://github.com/dongodid/cve-sub/blob/main/shiyi-blog/RCE.md exploit