Vulnerabilidades de Moxi624
CVEs publicadas que afetam produtos de Moxi624: 5 registro(s), com severidade, exploração e correções.
CVE-2026-109177
Média · 4.3
CWE-639 12/10/2026
MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.
CVE-2026-109176
Média · 5.4
CWE-639 12/10/2026
MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.
CVE-2026-109175
Média · 4.3
CWE-639 12/10/2026
MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.
CVE-2026-109174
Média · 6.5
CWE-863 12/10/2026
MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig
MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.
CVE-2026-6625
Alta · 7.3
CWE-918 20/04/2026
moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-side request forgery
A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this vulnerability is the function LocalFileServiceImpl.uploadPictureByUrl of the file mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/LocalFileServiceImpl.java of the component Picture Storage Service. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.