Approved changes feed: RSS · Atom
cpe:2.3:a:mogublog_project:mogublog:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mogublog Project (f6c664dc-6fec-571d-b0e5-2f823c1cabe6) |
|---|---|
| Product | Mogublog (992b627f-a59c-5e5d-ac13-9f45a2c7d57f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/moxi624/mogu_blog_v2 |
purl2cpe | 2026-06-01 10:11:51.024675 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-109176 |
vulnerable | 2026-11-03 10:17:40.107554 |
MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files
MEDIUM (5.4)
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.
Published: 2026-10-12T13:10:37.009Z
Updated: 2026-10-26T16:46:48.822Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-109175 |
vulnerable | 2026-11-03 10:17:39.748631 |
MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
MEDIUM (4.3)
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.
Published: 2026-10-12T13:10:36.311Z
Updated: 2026-10-13T18:44:36.282Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89262 |
vulnerable | 2026-09-16 04:34:09.618332 |
MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
HIGH (7.5)
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.
Published: 2026-09-11T15:25:17.192Z
Updated: 2026-09-24T14:21:38.190Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-89263 |
vulnerable | 2026-09-16 04:34:09.580402 |
MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint
MEDIUM (5.3)
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.
Published: 2026-09-11T15:25:17.890Z
Updated: 2026-09-24T14:21:39.147Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13816 |
vulnerable | 2026-06-08 07:06:32.767109 |
moxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unzip path traversal
MEDIUM (6.3)
A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of the file /networkDisk/unzipFile of the component ZIP File Handler. Such manipulation of the argument fileUrl leads to path traversal. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2025-12-01T08:32:05.364Z
Updated: 2025-12-01T14:05:54.284Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13815 |
vulnerable | 2026-06-08 07:06:32.766745 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13814 |
vulnerable | 2026-06-08 07:06:32.766254 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13813 |
vulnerable | 2026-06-08 07:06:32.765658 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-2101 |
vulnerable | 2026-06-08 06:02:41.420816 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.