moxi624 vulnerabilities

Products

• mogu blog v2 13

Latest moxi624 CVEs

Newest publication first

1. CVE-2026-109176 MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

   Published 2026-10-12

   Medium·CVSS 5.3 EPSS 0.22%

   MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, wh...

2. CVE-2026-109177 MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

   Published 2026-10-12

   Medium·CVSS 5.3 EPSS 0.20%

   MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile,...

3. CVE-2026-109175 MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

   Published 2026-10-12

   Medium·CVSS 5.3 EPSS 0.20%

   MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type,...

4. CVE-2026-109174 MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig

   Published 2026-10-12

   High·CVSS 7.1 EPSS 0.24%

   MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Q...

5. CVE-2026-90568 moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting

   Published 2026-09-13

   Medium·CVSS 5.1 EPSS 0.33%

   A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file mogu_web/src/main/resources/templates/info.ftl of the component blogSort Endpoint. The manipulation of the argument sortName results in cross site...

6. CVE-2026-89265 MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint

   Published 2026-09-11

   Medium·CVSS 5.3 EPSS 0.37%

   MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions ca...

7. CVE-2026-89264 MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity

   Published 2026-09-11

   Medium·CVSS 5.3 EPSS 0.37%

   MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts in...

8. CVE-2026-89262 MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

   Published 2026-09-11

   High·CVSS 8.7 EPSS 0.54%

   MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment U...

9. CVE-2026-89263 MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint

   Published 2026-09-11

   Medium·CVSS 6.9 EPSS 0.45%

   MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user id...

10. CVE-2026-89261 MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints

    Published 2026-09-11

    Medium·CVSS 6.9 EPSS 0.83%

    MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete spec...

11. CVE-2026-89260 MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

    Published 2026-09-11

    High·CVSS 8.7 EPSS 0.73%

    MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or ex...

12. CVE-2026-6625 moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery

    Published 2026-04-20

    Medium·CVSS 6.9 EPSS 0.30%

    A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this vulnerability is the function LocalFileServiceImpl.uploadPictureByUrl of the file mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/LocalFileServiceImpl.java of the comp...

13. CVE-2023-2101 moxi624 Mogu Blog v2 uploadPicsByUrl uploadPictureByUrl absolute path traversal

    Published 2023-04-15

    Medium·CVSS 6.5 EPSS 0.85%

    A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of the file /mogu-picture/file/uploadPicsByUrl. The manipulation of the argument urlList leads to absolute path traversal. Th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.