CVE-2023-2101

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of the file /mogu-picture/file/uploadPicsByUrl. The manipulation of the argument urlList leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226109 was assigned to this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-36

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-210104.4In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local inforCVE-2023-210114.4In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local inforCVE-2023-210124.4In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local inforCVE-2023-210134.4In forceStaDisconnection of hostapd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local infoCVE-2023-210144.4In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local inforCVE-2023-210157.8In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission checCVE-2023-210165.5In AccountTypePreference of AccountTypePreference.java, there is a possible way to mislead the user about accounts installed on the device dCVE-2023-210177.8In InstallStart of InstallStart.java, there is a possible way to change the installer package name due to an improper input validation. ThisCVE-2023-210186.7In UnwindingWorker of unwinding.cc, there is a possible out of bounds write due to a use after free. This could lead to local escalation of CVE-2023-210195.5In ih264e_init_proc_ctxt of ih264e_process.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to localCVE-2023-21024.8Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-210206.7In registerSignalHandlers of main.c, there is a possible local arbitrary code execution due to a use after free. This could lead to local es
CVE-2023-2101: Medium severity, CVSS 6.5 | Vulnix