EUVD-2026-97378

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO...

CVE-2026-109174

Versions of MoguBlog through 6.2 are vulnerable to an information disclosure vulnerability due to incorrect authorization (CWE-863) at the getSystemConfig endpoint. This flaw allows low-privileged front-end users to provide an ordinary reader session token to retrieve unfiltered SystemConfig data...