Mingsheng Lin

MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint

novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint

novel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint

novel-plus through 5.3.3 Default Cache Management Password in the Front Portal

MoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint

MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints

MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity