CVE-2026-90568— moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting
Quick assessment
Affected
moxi624 Mogu Blog v2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 moxi624 Mogu Blog v2（最高版本 5.2）中发现一个漏洞。该漏洞影响组件 blogSort 的端点，具体位于文件 中的函数 。 当参数 被操纵时，会导致跨站脚本攻击（XSS）。该攻击可远程发起。项目方已尽早通过问题报告得知此问题，但尚未作出回应。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90568
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file mogu_web/src/main/resources/templates/info.ftl of the component blogSort Endpoint. The manipulation of the argument sortName results in cross site scripting. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| moxi624 | Mogu Blog v2 | 4.0 |
cpe:2.3:a:moxi624:mogu_blog_v2:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-90568
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90568
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-90568 (1)
IV. Related Vulnerabilities
Same product: Mogu Blog v2
-
CVE-2026-6625
moxi624 Mogu Blog v2 Picture Storage Service LocalFileServic -
CVE-2025-13816
moxi159753 Mogu Blog v2 ZIP File unzipFile FileOperation.unz -
CVE-2025-13815
moxi159753 Mogu Blog v2 pictures unrestricted upload -
CVE-2025-13814
moxi159753 Mogu Blog v2 uploadPicsByUrl LocalFileServiceImpl -
CVE-2025-13813
moxi159753 Mogu Blog v2 Storage Management Endpoint storage
Same vendor: moxi624
-
CVE-2026-89265
MoguBlog through 6.2 Missing Authorization on the Admin getP -
CVE-2026-89264
MoguBlog through 6.2 Comment Author Spoofing via Request-Bod -
CVE-2026-89263
MoguBlog through 6.2 Missing Authentication on the Comment E -
CVE-2026-89262
MoguBlog through 6.2 Arbitrary Comment Deletion via Request- -
CVE-2026-89261
MoguBlog through 6.2 Missing Authentication for Elasticsearc
Same weakness: CWE-79
-
CVE-2026-90571
Exrick xmall Order Printing order-print.jsp cross site scrip -
CVE-2026-90570
linlinjava litemall Product Detail index.vue AdminGoodsServi -
CVE-2026-90569
linlinjava litemall Admin Topic index.vue AdminTopicControll -
CVE-2026-90567
quequnlong shiyi-blog Search index.vue highlightKeyword cros -
CVE-2026-90564
quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysCha
V. Comments for CVE-2026-90568
No comments yet