Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
21 results
Oct 12, 2026MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disCVE-2026-109177 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/moveFile, batchMoveFile, or edit, which update rows without admin_uid checks, relocating or renaming other users' files and folders.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files vCVE-2026-109176 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's file or folder uid, which NetworkDiskServiceImpl.deleteFile never checks against admin_uid, removing stored objects from local storage, Qiniu or MinIO.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-dCVE-2026-109175 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by status, file type, or filePath and never by admin_uid, to obtain other administrators' file names and download URLs.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2026MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConCVE-2026-109174 · Other software · moxi624 · reported by VulnCheckHigh 7.1
MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annoCVE-2026-89265 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributCVE-2026-89264 · Other software · moxi624 · reported by VulnCheckMedium 5.3
MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including administrators.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notCVE-2026-89263 · Other software · moxi624 · reported by VulnCheckMedium 6.9
MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields CVE-2026-89262 · Other software · moxi624 · reported by VulnCheckHigh 8.7
MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, reCVE-2026-89261 · Other software · moxi624 · reported by VulnCheckMedium 6.9
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck.CVE-2026-89260 · Other software · moxi624 · reported by VulnCheckHigh 8.7
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.
- Product
- MoguBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 12, 2022Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS).CVE-2022-30517 · Other software · Mogublog Project · reported by MITREMedium 6.1
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS).
- Product
- Mogublog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2018Axublog 1.1.0 allows remote Code Execution as demonstrated by injection of PHP code (contained in the webkeywords parameter) into the cmsconfig.php file.CVE-2018-10740 · Other software · Axublog · reported by MITRECritical 9.8
Axublog 1.1.0 allows remote Code Execution as demonstrated by injection of PHP code (contained in the webkeywords parameter) into the cmsconfig.php file.
- Product
- Axublog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2009SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL CVE-2008-6438 · Other software · E107coders · reported by MITREHigh 7.5
SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL commands via the uid parameter, a different vector than CVE-2008-2455. NOTE: it was later reported that 2.1.4 is also affected.
- Product
- Macguru Blog Engine Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2007SQL injection vulnerability in badword.asp in Ublog Reload 1.0.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2007-0799 · Other software · Uapplication · reported by MITREHigh 7.5
SQL injection vulnerability in badword.asp in Ublog Reload 1.0.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Ublog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orghackerscenter.com
Feb 6, 2007Multiple cross-site scripting (XSS) vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameteCVE-2007-0798 · Other software · Uapplication · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) login.asp; and allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters to (2) badword.asp, (3) polls.asp, and (4) users.asp.
- Product
- Ublog Reload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2006Cross-site scripting (XSS) vulnerability in UBlog 1.6 Access Edition allows remote attackers to inject arbitrary web script or HTML via text fields when adding CVE-2006-2246 · Other software · Uapplication · reported by MITREMedium 5.8
Cross-site scripting (XSS) vulnerability in UBlog 1.6 Access Edition allows remote attackers to inject arbitrary web script or HTML via text fields when adding a blog entry.
- Product
- Ublog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcolander.altervista.orgsecunia.com
Jun 20, 2005Multiple SQL injection vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) ci, (2) d, or (3) m parameter CVE-2005-2009 · Other software · Ublog · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in Ublog Reload 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) ci, (2) d, or (3) m parameter to index.asp, or the (4) bi parameter to blog_comment.asp.
- Product
- Reload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2005Cross-site scripting (XSS) vulnerability in trackback.asp in Ublog Reload 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the btitle paCVE-2005-2010 · Other software · Uapplication · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in trackback.asp in Ublog Reload 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the btitle parameter.
- Product
- Ublog Reload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2005Uapplication Ublog Reload stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a databaseCVE-2005-1426 · Other software · reported by MITREMedium 5
Uapplication Ublog Reload stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for mdb-database/blog.mdb (aka mdb-database/blog.msb).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comosvdb.org
May 2, 2005Ublog Reload 1.0 through 1.0.4 stores ublogreload.mdb under the web root, which allows remote attackers to read usernames and hashed passwords via a direct requCVE-2005-0938 · Other software · Uapplication · reported by MITREMedium 5
Ublog Reload 1.0 through 1.0.4 stores ublogreload.mdb under the web root, which allows remote attackers to read usernames and hashed passwords via a direct request to ublogreload.mdb.
- Product
- Ublog Reload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2005Cross-site scripting (XSS) vulnerability in login.asp for Ublog Reload 1.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the CVE-2005-0925 · Other software · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in login.asp for Ublog Reload 1.0 through 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.