Skip to content
OpenAdvisories

Vendor

moxi624

13 known vulnerabilities.

Products

MoguBlog 10 Mogu Blog v2 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-89262

    MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

    MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies b…

    moxi624 MoguBlog
  • High 7.5
    CVE-2026-89260

    MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

    MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXRea…

    moxi624 MoguBlog
  • High 7.3
    CVE-2026-6625

    moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery

    A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this vulnerability is the function LocalFileServiceImpl.uploadPictureByUrl of the file mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/LocalFileService…

    moxi624 Mogu Blog v2