moxi624 has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 7. The median CVSS is 5.3 (medium). None have a confirmed exploitation report. Most affected products: MoguBlog (6), Mogu Blog v2 (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Worst active — by depth score
CVE-2026-89262High· 7.5MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check53CVE-2026-89260High· 7.5MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint53CVE-2026-89261Medium· 6.5MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints48CVE-2026-89263Medium· 5.3MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users41CVE-2026-89265Medium· 4.3MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint36
moxi624 vulnerabilities
CVEs affecting moxi624, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-90568Low· 3.5A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2
A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file mogu_web/src/main/resources/templates/info.ftl of the component blogSort Endpoint. The manipulation of …
CVE-2026-89265Medium· 4.3PoCMoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office …
CVE-2026-89260High· 7.5PoCMoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an u…
CVE-2026-89262High· 7.5PoCMoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary commen…
CVE-2026-89261Medium· 6.5PoCMoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints t…
CVE-2026-89264Medium· 4.3PoCMoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the re…
CVE-2026-89263Medium· 5.3PoCMoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotif…