CVE-2026-89260highCWE-611

CVE-2026-89260: fallo de gravedad alta en moxi624 MoguBlog

MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear MoguBlog

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 8.7epss 0.7%
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
moxi624 · MoguBlog
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — moxi624 MoguBlog

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-89261MEDIUMMoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management EndpointsEPSS 0.8%CVE-2026-89262HIGHMoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership CheckEPSS 0.5%CVE-2026-89263MEDIUMMoguBlog through 6.2 Missing Authentication on the Comment Email-Notification EndpointEPSS 0.5%CVE-2026-89265MEDIUMMoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid EndpointEPSS 0.4%CVE-2026-89264MEDIUMMoguBlog through 6.2 Comment Author Spoofing via Request-Body IdentityEPSS 0.4%CVE-2026-109174HIGHMoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfigEPSS 0.2%