PT-2025-17378 · Unknown · Songquanpeng One-Api
Yaowenxiao
·
Published
2025-04-19
·
Updated
2025-04-23
·
CVE-2025-3801
CVSS v2.0
3.3
Low
| Vector | AV:N/AC:L/Au:M/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
songquanpeng one-api versions up to 0.6.10
Description
A vulnerability was found in the System Setting Handler component, allowing for cross-site scripting through the manipulation of the
Homepage Content argument. This issue can be exploited remotely. The exploit has been disclosed to the public.Recommendations
For songquanpeng one-api versions up to 0.6.10, consider disabling the System Setting Handler component or restricting access to it until a patch is available. Avoid using the
Homepage Content argument in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Songquanpeng One-Api