CVE-2026-90568
Received Received - Intake

Cross-Site Scripting in Mogu Blog v2

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSort of the file mogu_web/src/main/resources/templates/info.ftl of the component blogSort Endpoint. The manipulation of the argument sortName results in cross site scripting. The attack can be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90568
EUVD
EUVD-2026-77045

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
moxi624 mogu_blog to 5.2 (inc)
moxi624 mogu_blog From 4.0 (inc) to 5.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Mogu Blog v2. It occurs when a blog category name is saved without proper sanitization. When users view articles in that category, malicious scripts embedded in the category name execute in their browsers.

Detection Guidance

To detect this stored XSS vulnerability, inspect the Mogu Blog v2 application for unsanitized blog category names rendered in article pages. Check the Freemarker template info.ftl for direct output of sortName without HTML escaping. Review backend methods BlogSortServiceImpl.addBlogSort and editBlogSort for missing input validation.

Impact Analysis

An attacker with blog management privileges could inject malicious scripts. These scripts could steal user session cookies, redirect users to phishing sites, or perform actions on their behalf when they view compromised articles.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may compromise protected health information by allowing script execution in user sessions.

Mitigation Strategies

Implement HTML encoding in the Freemarker template info.ftl for sortName output. Add input validation to reject HTML tags and enforce length constraints for sortName in BlogSortServiceImpl.addBlogSort and editBlogSort methods. Ensure regression tests cover the data flow from backend input to frontend output.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90568. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart