Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-116216 (GCVE-0-2026-116216)

Vulnerability from nvd – Published: 2026-10-26 13:08 – Updated: 2026-11-02 17:35

Title

MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

Summary

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 17:35 UTC

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-t…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , ≤ 2026.1000.4056 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T17:35:05.344140Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T17:35:24.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "2026.1000.4056",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member\u0027s avatar and impersonating them."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:48.563Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/index/controller/Comment.php#L37-L95"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-comment-impersonation-via-user-id-mass-assignment"
        }
      ],
      "title": "MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116216",
    "datePublished": "2026-10-26T13:08:48.563Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-11-02T17:35:24.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116215 (GCVE-0-2026-116215)

Vulnerability from nvd – Published: 2026-10-26 13:08 – Updated: 2026-10-31 01:20

Title

MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

Summary

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-31 01:20 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-t…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , ≤ 2026.1000.4056 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-31T01:20:20.915628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-31T01:20:31.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "2026.1000.4056",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:47.862Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/Card.php#L123-L160"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-race-condition-via-card-redemption"
        }
      ],
      "title": "MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116215",
    "datePublished": "2026-10-26T13:08:47.862Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-10-31T01:20:31.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116214 (GCVE-0-2026-116214)

Vulnerability from nvd – Published: 2026-10-26 13:08 – Updated: 2026-11-04 20:39

Title

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

Summary

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 20:39 UTC

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/magicblack/maccms10/commit/27b…	patch
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-b…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , < 2026.1000.4054 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116214",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T20:39:36.839775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:39:45.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThan": "2026.1000.4054",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member\u0027s password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim\u0027s email or phone to take over the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:47.141Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630"
        },
        {
          "name": "Fix Commit (magicblack/maccms10)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code"
        }
      ],
      "title": "MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116214",
    "datePublished": "2026-10-26T13:08:47.141Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-11-04T20:39:45.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-90788 (GCVE-0-2026-90788)

Vulnerability from nvd – Published: 2026-09-14 14:00 – Updated: 2026-09-16 15:05

Title

magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection

Summary

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

4.7 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 15:05 UTC

CWE

CWE-78 - OS Command Injection
CWE-77 - Command Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3855 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/403294	vdb-entry
https://vuldb.com/vuln/403294/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90788	third-party-advisory
https://vuldb.com/submit/919268	third-party-advisory
https://github.com/magicblack/maccms10/issues/1378	exploitissue-tracking
https://github.com/magicblack/maccms10/	product

Impacted products

1 product

Vendor	Product	Version
magicblack	MacCMS10	Affected: 2026.1000.4055 cpe:2.3:a:magicblack:maccms10::::::::

Credits

seikruun (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90788",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:05:14.422569Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:05:33.080Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:magicblack:maccms10:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Template Handler"
          ],
          "product": "MacCMS10",
          "vendor": "magicblack",
          "versions": [
            {
              "status": "affected",
              "version": "2026.1000.4055"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "seikruun (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T14:00:09.959Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-403294 | magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/403294"
        },
        {
          "name": "VDB-403294 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/403294/cti"
        },
        {
          "name": "CVE-2026-90788 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-90788"
        },
        {
          "name": "Submit #919268 | MacCMS MacCMS10 maccms10-2026.1000.4055 OS Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/919268"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/magicblack/maccms10/issues/1378"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/magicblack/maccms10/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-13T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-13T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-13T15:17:21.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-90788",
    "datePublished": "2026-09-14T14:00:09.959Z",
    "dateReserved": "2026-09-13T13:12:14.654Z",
    "dateUpdated": "2026-09-16T15:05:33.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71232 (GCVE-0-2026-71232)

Vulnerability from nvd – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:45

Title

MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

Summary

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 12:53 UTC

CWE

CWE-94 - Code Injection

Assigner

TuranSec CNA under the mitre root

CNA scorecard C 70/100 over 189 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/magicblack/maccms10/commit/71a…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
magicblack	maccms10	Affected: 0 , ≤ 10 (custom)

Date Public

2026-08-05 10:56

Credits

Mirdavlatov Mira'zam

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71232",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T12:53:18.041904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T12:53:53.406Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "maccms10",
          "programFiles": [
            "application/admin/controller/Template.php"
          ],
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mirdavlatov Mira\u0027zam"
        }
      ],
      "datePublic": "2026-08-05T10:56:15.883Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMacCMS10\u0027s admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.\u003c/p\u003e"
            }
          ],
          "value": "MacCMS10\u0027s admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T11:45:29.873Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71232",
    "datePublished": "2026-08-05T10:56:15.883Z",
    "dateReserved": "2026-08-05T10:53:53.175Z",
    "dateUpdated": "2026-08-10T11:45:29.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116216 (GCVE-0-2026-116216)

Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-11-02 17:35

Title

MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

Summary

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 17:35 UTC

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-t…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , ≤ 2026.1000.4056 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116216",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T17:35:05.344140Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T17:35:24.018Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "2026.1000.4056",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member\u0027s avatar and impersonating them."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:48.563Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/index/controller/Comment.php#L37-L95"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-comment-impersonation-via-user-id-mass-assignment"
        }
      ],
      "title": "MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116216",
    "datePublished": "2026-10-26T13:08:48.563Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-11-02T17:35:24.018Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116215 (GCVE-0-2026-116215)

Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-10-31 01:20

Title

MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

Summary

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-31 01:20 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-t…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , ≤ 2026.1000.4056 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116215",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-31T01:20:20.915628Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-31T01:20:31.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "2026.1000.4056",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:47.862Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/Card.php#L123-L160"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-race-condition-via-card-redemption"
        }
      ],
      "title": "MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116215",
    "datePublished": "2026-10-26T13:08:47.862Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-10-31T01:20:31.938Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116214 (GCVE-0-2026-116214)

Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-11-04 20:39

Title

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

Summary

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 20:39 UTC

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/magicblack/maccms10/commit/27b…	patch
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-b…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , < 2026.1000.4054 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116214",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T20:39:36.839775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:39:45.870Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThan": "2026.1000.4054",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member\u0027s password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim\u0027s email or phone to take over the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:47.141Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630"
        },
        {
          "name": "Fix Commit (magicblack/maccms10)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code"
        }
      ],
      "title": "MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116214",
    "datePublished": "2026-10-26T13:08:47.141Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-11-04T20:39:45.870Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-90788 (GCVE-0-2026-90788)

Vulnerability from cvelistv5 – Published: 2026-09-14 14:00 – Updated: 2026-09-16 15:05

Title

magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection

Summary

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

4.7 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 15:05 UTC

CWE

CWE-78 - OS Command Injection
CWE-77 - Command Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 83/100 over 3855 records in the last 180 days details

References

6 references

URL	Tags
https://vuldb.com/vuln/403294	vdb-entry
https://vuldb.com/vuln/403294/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90788	third-party-advisory
https://vuldb.com/submit/919268	third-party-advisory
https://github.com/magicblack/maccms10/issues/1378	exploitissue-tracking
https://github.com/magicblack/maccms10/	product

Impacted products

1 product

Vendor	Product	Version
magicblack	MacCMS10	Affected: 2026.1000.4055 cpe:2.3:a:magicblack:maccms10::::::::

Credits

seikruun (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90788",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:05:14.422569Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:05:33.080Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:magicblack:maccms10:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Template Handler"
          ],
          "product": "MacCMS10",
          "vendor": "magicblack",
          "versions": [
            {
              "status": "affected",
              "version": "2026.1000.4055"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "seikruun (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T14:00:09.959Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-403294 | magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/403294"
        },
        {
          "name": "VDB-403294 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/403294/cti"
        },
        {
          "name": "CVE-2026-90788 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-90788"
        },
        {
          "name": "Submit #919268 | MacCMS MacCMS10 maccms10-2026.1000.4055 OS Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/919268"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/magicblack/maccms10/issues/1378"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/magicblack/maccms10/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-13T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-09-13T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-09-13T15:17:21.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection",
      "x_generator": [
        "VulDB PVTS v202609"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-90788",
    "datePublished": "2026-09-14T14:00:09.959Z",
    "dateReserved": "2026-09-13T13:12:14.654Z",
    "dateUpdated": "2026-09-16T15:05:33.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71232 (GCVE-0-2026-71232)

Vulnerability from cvelistv5 – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:45

Title

MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

Summary

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-05 12:53 UTC

CWE

CWE-94 - Code Injection

Assigner

TuranSec CNA under the mitre root

CNA scorecard C 70/100 over 189 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/magicblack/maccms10/commit/71a…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
magicblack	maccms10	Affected: 0 , ≤ 10 (custom)

Date Public

2026-08-05 10:56

Credits

Mirdavlatov Mira'zam

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71232",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-05T12:53:18.041904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T12:53:53.406Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "maccms10",
          "programFiles": [
            "application/admin/controller/Template.php"
          ],
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mirdavlatov Mira\u0027zam"
        }
      ],
      "datePublic": "2026-08-05T10:56:15.883Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMacCMS10\u0027s admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.\u003c/p\u003e"
            }
          ],
          "value": "MacCMS10\u0027s admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94 Code Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T11:45:29.873Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-71232",
    "datePublished": "2026-08-05T10:56:15.883Z",
    "dateReserved": "2026-08-05T10:53:53.175Z",
    "dateUpdated": "2026-08-10T11:45:29.873Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

10 vulnerabilities found for MacCMS10 by magicblack

CVE-2026-116216 (GCVE-0-2026-116216)

CVE-2026-116215 (GCVE-0-2026-116215)

CVE-2026-116214 (GCVE-0-2026-116214)

CVE-2026-90788 (GCVE-0-2026-90788)

CVE-2026-71232 (GCVE-0-2026-71232)

CVE-2026-116216 (GCVE-0-2026-116216)

CVE-2026-116215 (GCVE-0-2026-116215)

CVE-2026-116214 (GCVE-0-2026-116214)

CVE-2026-90788 (GCVE-0-2026-90788)

CVE-2026-71232 (GCVE-0-2026-71232)