GCVE - cpe:2.3:a:moxi624:mogublog:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:moxi624:mogublog:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Moxi624 (`68ba4ec6-030b-5d63-b2fa-46b28b46c66f`)
Product	Mogublog (`427afc24-0c34-5af9-a0b8-e79639c8f301`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-89262`	vulnerable	2026-09-16 04:34:09.617764	MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check HIGH (7.5) MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints. Published: 2026-09-11T15:25:17.192Z Updated: 2026-09-24T14:21:38.190Z Open on db.gcve.eu Reference links https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C04_comment_delete_idor.py https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/config/WebSecurityConfig.java https://gitee.com/moxi159753/mogu_blog_v2/releases https://github.com/moxi624/mogu_blog_v2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-89263`	vulnerable	2026-09-16 04:34:09.579412	MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint MEDIUM (5.3) MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization. Published: 2026-09-11T15:25:17.890Z Updated: 2026-09-24T14:21:39.147Z Open on db.gcve.eu Reference links https://github.com/LinYuanyi1/cve-request-poc/blob/master/mogublog-poc/C08_comment_closeEmailNotification.py https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/restapi/CommentRestApi.java https://github.com/moxi624/mogu_blog_v2/blob/025d78c7ac7e19b1abf796fa3cc158d855723d15/mogu_web/src/main/java/com/moxi/mogublog/web/config/WebSecurityConfig.java https://gitee.com/moxi159753/mogu_blog_v2/releases https://github.com/moxi624/mogu_blog_v2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.