Moxi624 vulnerabilities
We track 3 vulnerabilities in Moxi624 products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 11, 2026.
Latest Moxi624 vulnerabilities
- 7.5 High severity
MoguBlog: Authorization Bypass Through User-Controlled Key
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by
- 7.5 High severity
MoguBlog: Improper Restriction of XML External Entity Reference
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXRead
- 7.3 High severity
Mogu Blog v2: Server-Side Request Forgery
A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this vulnerability is the function LocalFileServiceImpl.uploadPictureByUrl of the file mogu_picture/src/main/java/com/moxi/mogublog/picture/service/impl/LocalFileServiceI