Which versions of Mogublog are affected by CVE-2025-13813?

Organizations using moxi159753 Mogu Blog should be aware of moderate risk from CVE-2025-13813, a missing authorization vulnerability rated CVSS 5.6.

Is there a public PoC exploit available for CVE-2025-13813?

Yes, a public proof-of-concept exploit is available for CVE-2025-13813. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-13813?

Within 30 days: Identify affected systems running moxi159753 Mogu Blog and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Mogublog CVE-2025-13813

Q: What is the CVSS score of CVE-2025-13813?

CVE-2025-13813 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-199958 LOW

Missing Authorization (CWE-862)

2025-12-01 cna@vuldb.com

Authentication Bypass Mogublog Mogublog Project

2.9

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.6 (MEDIUM) 2.9 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 13:34 euvd

EUVD-2025-199958

Analysis Generated

Mar 15, 2026 - 13:34 vuln.today

PoC Detected

Dec 03, 2025 - 22:02 vuln.today

Public exploit code

CVE Published

Dec 01, 2025 - 07:16 nvd

MEDIUM 5.6

CVE Published

Dec 01, 2025 - 07:16 cve.org

LOW 2.9

DescriptionCVE.org

A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the file /storage/ of the component Storage Management Endpoint. The manipulation leads to missing authorization. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is assessed as difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Missing authorization in the Storage Management Endpoint of Mogu Blog v2 (up to version 5.2) enables unauthenticated remote attackers to access or manipulate files in the /storage/ directory. The attack complexity is high and a publicly available exploit exists, though no active exploitation is confirmed and EPSS indicates very low likelihood of exploitation.