EUVD-2025-199960Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
Lifecycle Timeline
7DescriptionCVE.org
A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures. This manipulation of the argument filedatas causes unrestricted upload. The attack may be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Unrestricted file upload in Mogu Blog v2 up to version 5.2 allows remote attackers with low privileges to upload arbitrary files via the /file/pictures endpoint by manipulating the filedatas argument. A public proof-of-concept exploit is available, but no active exploitation has been confirmed by CISA KEV. The EPSS exploitation probability is 0.05%, indicating low likelihood of widespread exploitation.
Unauthenticated arbitrary comment deletion in MoguBlog through 6.2 allows remote attackers to permanently remove any com
Unauthenticated XML external entity injection in MoguBlog through version 6.2 allows remote attackers to read arbitrary
Unauthenticated integrity manipulation in MoguBlog through 6.2 allows any remote caller to silently disable email reply
Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through versi
A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. Rated medium sev
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 6.1), this vulnerability is remot
Server-side request forgery in Mogu Blog v2 up to version 5.2 allows remote, unauthenticated attackers to force the serv
Missing authorization on a MoguBlog admin-backend endpoint allows authenticated back-office users to retrieve image-cate
Comment author spoofing in MoguBlog through version 6.2 allows any authenticated user to post comments attributed to arb
Missing authorization in the Storage Management Endpoint of Mogu Blog v2 (up to version 5.2) enables unauthenticated rem
Authenticated path traversal in Mogu Blog v2 up to 5.2 allows remote attackers to write files to arbitrary directories v
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today