MO
Vendor
moxi624
12
CVEs
0
On KEV
4
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109177 | MO MoguBlog moxi624 | 4.3 | Oct 12 | MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit |
| CVE-2026-109176 | MO MoguBlog moxi624 | 5.4 | Oct 12 | MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files |
| CVE-2026-109175 | MO MoguBlog moxi624 | 4.3 | Oct 12 | MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList |
| CVE-2026-109174 | MO MoguBlog moxi624 | 6.5 | Oct 12 | MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig |
| CVE-2026-90568 | MB Mogu Blog v2 moxi624 | 3.5 | Sep 13 | moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting |
| CVE-2026-89265 | MO MoguBlog moxi624 | 4.3 | Sep 11 | MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint |
| CVE-2026-89264 | MO MoguBlog moxi624 | 4.3 | Sep 11 | MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity |
| CVE-2026-89263 | MO MoguBlog moxi624 | 5.3 | Sep 11 | MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint |
| CVE-2026-89262 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check |
| CVE-2026-89261 | MO MoguBlog moxi624 | 6.5 | Sep 11 | MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints |
| CVE-2026-89260 | MO MoguBlog moxi624 | 7.5 | Sep 11 | MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint |
| CVE-2026-6625 | MB Mogu Blog v2 moxi624 | 7.3 | Apr 20 | moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery |