Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-116216 (GCVE-0-2026-116216)

Vulnerability from nvd – Published: 2026-10-26 13:08 – Updated: 2026-10-26 13:08

Title

MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

Summary

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6903 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-t…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , ≤ 2026.1000.4056 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "2026.1000.4056",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member\u0027s avatar and impersonating them."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:48.563Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/index/controller/Comment.php#L37-L95"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-comment-impersonation-via-user-id-mass-assignment"
        }
      ],
      "title": "MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116216",
    "datePublished": "2026-10-26T13:08:48.563Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-10-26T13:08:48.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116215 (GCVE-0-2026-116215)

Vulnerability from nvd – Published: 2026-10-26 13:08 – Updated: 2026-10-26 13:08

Title

MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

Summary

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6903 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-t…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , ≤ 2026.1000.4056 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "2026.1000.4056",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:47.862Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/Card.php#L123-L160"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-race-condition-via-card-redemption"
        }
      ],
      "title": "MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116215",
    "datePublished": "2026-10-26T13:08:47.862Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-10-26T13:08:47.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116214 (GCVE-0-2026-116214)

Vulnerability from nvd – Published: 2026-10-26 13:08 – Updated: 2026-10-26 13:08

Title

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

Summary

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6903 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/magicblack/maccms10/commit/27b…	patch
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-b…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , < 2026.1000.4054 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThan": "2026.1000.4054",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member\u0027s password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim\u0027s email or phone to take over the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:47.141Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630"
        },
        {
          "name": "Fix Commit (magicblack/maccms10)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code"
        }
      ],
      "title": "MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116214",
    "datePublished": "2026-10-26T13:08:47.141Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-10-26T13:08:47.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116216 (GCVE-0-2026-116216)

Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-10-26 13:08

Title

MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

Summary

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6903 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-t…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , ≤ 2026.1000.4056 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "2026.1000.4056",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member\u0027s avatar and impersonating them."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:48.563Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/index/controller/Comment.php#L37-L95"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-comment-impersonation-via-user-id-mass-assignment"
        }
      ],
      "title": "MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116216",
    "datePublished": "2026-10-26T13:08:48.563Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-10-26T13:08:48.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116215 (GCVE-0-2026-116215)

Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-10-26 13:08

Title

MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

Summary

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6903 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-t…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , ≤ 2026.1000.4056 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThanOrEqual": "2026.1000.4056",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:47.862Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/Card.php#L123-L160"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-race-condition-via-card-redemption"
        }
      ],
      "title": "MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116215",
    "datePublished": "2026-10-26T13:08:47.862Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-10-26T13:08:47.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-116214 (GCVE-0-2026-116214)

Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-10-26 13:08

Title

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

Summary

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-640 - Weak Password Recovery Mechanism for Forgotten Password

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6903 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/maccmspro/maccms10/issues/30	issue-tracking
https://github.com/maccmspro/maccms10/blob/7f388e…	technical-description
https://github.com/magicblack/maccms10/commit/27b…	patch
https://github.com/maccmspro/maccms10	product
https://www.vulncheck.com/advisories/maccms-v10-b…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
maccmspro	maccms10	Affected: 0 , ≤ 2021.1000.2000 (custom)
magicblack	maccms10	Affected: 0 , < 2026.1000.4054 (custom)

Date Public

2026-10-25 00:00

Credits

Abu Raihan Biswas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "maccmspro",
          "versions": [
            {
              "lessThanOrEqual": "2021.1000.2000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "maccms10",
          "vendor": "magicblack",
          "versions": [
            {
              "lessThan": "2026.1000.4054",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abu Raihan Biswas"
        }
      ],
      "datePublic": "2026-10-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member\u0027s password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim\u0027s email or phone to take over the account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-640",
              "description": "Weak Password Recovery Mechanism for Forgotten Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T13:08:47.141Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #30",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/maccmspro/maccms10/issues/30"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630"
        },
        {
          "name": "Fix Commit (magicblack/maccms10)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/maccmspro/maccms10"
        },
        {
          "name": "VulnCheck Advisory: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code"
        }
      ],
      "title": "MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-116214",
    "datePublished": "2026-10-26T13:08:47.141Z",
    "dateReserved": "2026-10-25T12:28:44.091Z",
    "dateUpdated": "2026-10-26T13:08:47.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for maccms10 by maccmspro

CVE-2026-116216 (GCVE-0-2026-116216)

CVE-2026-116215 (GCVE-0-2026-116215)

CVE-2026-116214 (GCVE-0-2026-116214)

CVE-2026-116216 (GCVE-0-2026-116216)

CVE-2026-116215 (GCVE-0-2026-116215)

CVE-2026-116214 (GCVE-0-2026-116214)