Skip to content
OpenAdvisories

Product · moxi624

MoguBlog

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-89262

    MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

    MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies b…

    moxi624 MoguBlog
  • High 7.5
    CVE-2026-89260

    MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

    MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXRea…

    moxi624 MoguBlog