CVE-2026-109174

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO...

CVE-2026-109175

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

CVE-2026-109177

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109176

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

CVE-2026-109176 MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

CVE-2026-109176 MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

EUVD-2026-97380

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

CVE-2026-109176

MoguBlog versions through 6.2 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The issue exists because the NetworkDiskServiceImpl.deleteFile method fails to validate the file or folder uid against the admin_uid. This allows authenticated administrators to delete files ...

EUVD-2026-97381

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109177 MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which...

CVE-2026-109177

MoguBlog versions up to and including 6.2 are vulnerable to a broken access control flaw. The issue stems from a lack of admin_uid checks when processing specific requests, allowing authenticated administrators to move or rename network-disk files belonging to other administrators. By sending cra...

CVE-2026-109175 MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

CVE-2026-109175

MoguBlog versions through 6.2 are affected by an insecure direct object reference vulnerability in the /networkDisk/getFileList endpoint. Authenticated administrators can list network-disk files belonging to other administrators because the system filters by status, file type, or filePath but fai...

CVE-2026-109175 MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

EUVD-2026-97379

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and...

CVE-2026-109174 MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO...

CVE-2026-109174

Versions of MoguBlog through 6.2 are vulnerable to an information disclosure vulnerability due to incorrect authorization (CWE-863) at the getSystemConfig endpoint. This flaw allows low-privileged front-end users to provide an ordinary reader session token to retrieve unfiltered SystemConfig data...

EUVD-2026-97378

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO...

CVE-2026-109174 MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO...

CVE-2026-109176: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...