MoguBlog vulnerabilities

2 known vulnerabilities in MoguBlog from Moxi624. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  MoguBlog: Authorization Bypass Through User-Controlled Key

  CVE-2026-89262Sep 11, 2026Moxi624

  MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by

• 7.5 High severity

  MoguBlog: Improper Restriction of XML External Entity Reference

  CVE-2026-89260Sep 11, 2026Moxi624

  MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXRead