CVE-2026-89260highCWE-611

CVE-2026-89260: falha de alta gravidade em moxi624 MoguBlog

MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar MoguBlog

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 8.7epss 0.7%
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
moxi624 · MoguBlog
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — moxi624 MoguBlog

No mesmo produto, das mais perigosas para as menos.

CVE-2026-89261MEDIUMMoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management EndpointsEPSS 0.8%CVE-2026-89262HIGHMoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership CheckEPSS 0.5%CVE-2026-89263MEDIUMMoguBlog through 6.2 Missing Authentication on the Comment Email-Notification EndpointEPSS 0.5%CVE-2026-89265MEDIUMMoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid EndpointEPSS 0.4%CVE-2026-89264MEDIUMMoguBlog through 6.2 Comment Author Spoofing via Request-Body IdentityEPSS 0.4%CVE-2026-109174HIGHMoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfigEPSS 0.2%