CVE-2026-109176

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

CVE-2026-109176

MoguBlog versions through 6.2 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The issue exists because the NetworkDiskServiceImpl.deleteFile method fails to validate the file or folder uid against the admin_uid. This allows authenticated administrators to delete files ...

EUVD-2026-97380

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

CVE-2026-109176 MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

PT-2026-110565

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...

CVE-2026-109176: Authorization Bypass Through User-Controlled Key

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which...