Search
Find a vulnerability
Search criteria
16 vulnerabilities by Magicblack
CVE-2026-116216 (GCVE-0-2026-116216)
Vulnerability from nvd – Published: 2026-10-26 13:08 – Updated: 2026-11-02 17:35
VLAI
EPSS
VEX
Title
MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment
Summary
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:35 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maccmspro/maccms10/issues/30 | issue-tracking |
| https://github.com/maccmspro/maccms10/blob/7f388e… | technical-description |
| https://github.com/maccmspro/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-t… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| maccmspro | maccms10 |
Affected:
0 , ≤ 2021.1000.2000
(custom)
|
|
| magicblack | maccms10 |
Affected:
0 , ≤ 2026.1000.4056
(custom)
|
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116216",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:35:05.344140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:35:24.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "maccmspro",
"versions": [
{
"lessThanOrEqual": "2021.1000.2000",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "2026.1000.4056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Raihan Biswas"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member\u0027s avatar and impersonating them."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:08:48.563Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #30",
"tags": [
"issue-tracking"
],
"url": "https://github.com/maccmspro/maccms10/issues/30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/index/controller/Comment.php#L37-L95"
},
{
"tags": [
"product"
],
"url": "https://github.com/maccmspro/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-comment-impersonation-via-user-id-mass-assignment"
}
],
"title": "MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116216",
"datePublished": "2026-10-26T13:08:48.563Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-11-02T17:35:24.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116215 (GCVE-0-2026-116215)
Vulnerability from nvd – Published: 2026-10-26 13:08 – Updated: 2026-10-31 01:20
VLAI
EPSS
VEX
Title
MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption
Summary
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-31 01:20 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maccmspro/maccms10/issues/30 | issue-tracking |
| https://github.com/maccmspro/maccms10/blob/7f388e… | technical-description |
| https://github.com/maccmspro/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-t… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| maccmspro | maccms10 |
Affected:
0 , ≤ 2021.1000.2000
(custom)
|
|
| magicblack | maccms10 |
Affected:
0 , ≤ 2026.1000.4056
(custom)
|
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-31T01:20:20.915628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T01:20:31.938Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "maccmspro",
"versions": [
{
"lessThanOrEqual": "2021.1000.2000",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "2026.1000.4056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Raihan Biswas"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:08:47.862Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #30",
"tags": [
"issue-tracking"
],
"url": "https://github.com/maccmspro/maccms10/issues/30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/Card.php#L123-L160"
},
{
"tags": [
"product"
],
"url": "https://github.com/maccmspro/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-race-condition-via-card-redemption"
}
],
"title": "MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116215",
"datePublished": "2026-10-26T13:08:47.862Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-10-31T01:20:31.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116214 (GCVE-0-2026-116214)
Vulnerability from nvd – Published: 2026-10-26 13:08 – Updated: 2026-11-04 20:39
VLAI
EPSS
VEX
Title
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
Summary
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:39 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/maccmspro/maccms10/issues/30 | issue-tracking |
| https://github.com/maccmspro/maccms10/blob/7f388e… | technical-description |
| https://github.com/magicblack/maccms10/commit/27b… | patch |
| https://github.com/maccmspro/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-b… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| maccmspro | maccms10 |
Affected:
0 , ≤ 2021.1000.2000
(custom)
|
|
| magicblack | maccms10 |
Affected:
0 , < 2026.1000.4054
(custom)
|
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116214",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:39:36.839775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:39:45.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "maccmspro",
"versions": [
{
"lessThanOrEqual": "2021.1000.2000",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThan": "2026.1000.4054",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Raihan Biswas"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member\u0027s password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim\u0027s email or phone to take over the account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:08:47.141Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #30",
"tags": [
"issue-tracking"
],
"url": "https://github.com/maccmspro/maccms10/issues/30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630"
},
{
"name": "Fix Commit (magicblack/maccms10)",
"tags": [
"patch"
],
"url": "https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a"
},
{
"tags": [
"product"
],
"url": "https://github.com/maccmspro/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code"
}
],
"title": "MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116214",
"datePublished": "2026-10-26T13:08:47.141Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-11-04T20:39:45.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111356 (GCVE-0-2026-111356)
Vulnerability from nvd – Published: 2026-10-15 21:43 – Updated: 2026-10-16 16:49
VLAI
EPSS
VEX
Title
MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
Summary
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:49 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/maccms10-passwor… | third-party-advisory |
| https://github.com/magicblack/maccms10/blob/v2026… | technical-description |
| https://github.com/magicblack/maccms10/blob/v2026… | technical-description |
| https://github.com/magicblack/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| magicblack | MacCMS |
Affected:
0 , ≤ 2026.1000.4056
(custom)
cpe:2.3:a:maccms:maccms:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111356",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:49:26.985761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:49:52.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/maccms10-password-reset-code-brute-force-account-takeover"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/magicblack/maccms10",
"product": "MacCMS",
"repo": "https://github.com/magicblack/maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "2026.1000.4056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:maccms:maccms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2026.1000.4056",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim\u0027s email or phone can request a code and brute-force findpass_reset to overwrite the member\u0027s password."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:45.212Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/maccms10-password-reset-code-brute-force-account-takeover"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1199-L1231"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1397-L1450"
},
{
"tags": [
"product"
],
"url": "https://github.com/magicblack/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-account-takeover-via-password-recovery-brute-force"
}
],
"title": "MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111356",
"datePublished": "2026-10-15T21:43:45.212Z",
"dateReserved": "2026-10-15T20:56:53.414Z",
"dateUpdated": "2026-10-16T16:49:52.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90788 (GCVE-0-2026-90788)
Vulnerability from nvd – Published: 2026-09-14 14:00 – Updated: 2026-09-16 15:05
VLAI
EPSS
VEX
Title
magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection
Summary
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 15:05 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403294 | vdb-entry |
| https://vuldb.com/vuln/403294/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90788 | third-party-advisory |
| https://vuldb.com/submit/919268 | third-party-advisory |
| https://github.com/magicblack/maccms10/issues/1378 | exploitissue-tracking |
| https://github.com/magicblack/maccms10/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| magicblack | MacCMS10 |
Affected:
2026.1000.4055
cpe:2.3:a:magicblack:maccms10:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90788",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T15:05:14.422569Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:05:33.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:magicblack:maccms10:*:*:*:*:*:*:*:*"
],
"modules": [
"Template Handler"
],
"product": "MacCMS10",
"vendor": "magicblack",
"versions": [
{
"status": "affected",
"version": "2026.1000.4055"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "seikruun (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T14:00:09.959Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403294 | magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/403294"
},
{
"name": "VDB-403294 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403294/cti"
},
{
"name": "CVE-2026-90788 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90788"
},
{
"name": "Submit #919268 | MacCMS MacCMS10 maccms10-2026.1000.4055 OS Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/919268"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/magicblack/maccms10/issues/1378"
},
{
"tags": [
"product"
],
"url": "https://github.com/magicblack/maccms10/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T15:17:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90788",
"datePublished": "2026-09-14T14:00:09.959Z",
"dateReserved": "2026-09-13T13:12:14.654Z",
"dateUpdated": "2026-09-16T15:05:33.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71232 (GCVE-0-2026-71232)
Vulnerability from nvd – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:45
VLAI
EPSS
VEX
Title
MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
Summary
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 12:53 UTC
CWE
- CWE-94 - Code Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/magicblack/maccms10/commit/71a… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| magicblack | maccms10 |
Affected:
0 , ≤ 10
(custom)
|
Date Public
2026-08-05 10:56
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71232",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T12:53:18.041904Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:53:53.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "maccms10",
"programFiles": [
"application/admin/controller/Template.php"
],
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mirdavlatov Mira\u0027zam"
}
],
"datePublic": "2026-08-05T10:56:15.883Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMacCMS10\u0027s admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.\u003c/p\u003e"
}
],
"value": "MacCMS10\u0027s admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:45:29.873Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71232",
"datePublished": "2026-08-05T10:56:15.883Z",
"dateReserved": "2026-08-05T10:53:53.175Z",
"dateUpdated": "2026-08-10T11:45:29.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-10397 (GCVE-0-2025-10397)
Vulnerability from nvd – Published: 2025-09-14 11:02 – Updated: 2025-09-15 20:13
VLAI
EPSS
VEX
Title
Magicblack MacCMS API server-side request forgery
Summary
A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-15 20:13 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.323832 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.323832 | signaturepermissions-required |
| https://vuldb.com/?submit.645805 | third-party-advisory |
| https://github.com/August829/Yu/blob/main/58ead8e… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Magicblack | MacCMS |
Affected:
2025.1000.4050
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10397",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T20:13:05.040214Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T20:13:17.742Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"API Handler"
],
"product": "MacCMS",
"vendor": "Magicblack",
"versions": [
{
"status": "affected",
"version": "2025.1000.4050"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yu Bao (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in Magicblack MacCMS 2025.1000.4050 gefunden. Es geht dabei um eine nicht klar definierte Funktion der Komponente API Handler. Die Ver\u00e4nderung des Parameters cjurl resultiert in server-side request forgery. Der Angriff kann \u00fcber das Netzwerk passieren. Die Schwachstelle wurde \u00f6ffentlich offengelegt und k\u00f6nnte ausgenutzt werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-14T11:02:05.683Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-323832 | Magicblack MacCMS API server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.323832"
},
{
"name": "VDB-323832 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.323832"
},
{
"name": "Submit #645805 | magicblack MacCMSv10 v2025.1000.4050 SSRF",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.645805"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/August829/Yu/blob/main/58ead8e7e08bfb018.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-09-13T19:34:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "Magicblack MacCMS API server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-10397",
"datePublished": "2025-09-14T11:02:05.683Z",
"dateReserved": "2025-09-13T17:29:22.553Z",
"dateUpdated": "2025-09-15T20:13:17.742Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-10395 (GCVE-0-2025-10395)
Vulnerability from nvd – Published: 2025-09-14 08:02 – Updated: 2025-09-15 20:11
VLAI
EPSS
VEX
Title
Magicblack MacCMS Scheduled Task col_url server-side request forgery
Summary
A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-15 20:11 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.323830 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.323830 | signaturepermissions-required |
| https://vuldb.com/?submit.645798 | third-party-advisory |
| https://github.com/August829/Yu/blob/main/58ead8e… | related |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Magicblack | MacCMS |
Affected:
2025.1000.4050
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T20:11:34.882549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T20:11:53.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Scheduled Task Handler"
],
"product": "MacCMS",
"vendor": "Magicblack",
"versions": [
{
"status": "affected",
"version": "2025.1000.4050"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yu Bao (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely."
},
{
"lang": "de",
"value": "In Magicblack MacCMS 2025.1000.4050 wurde eine Schwachstelle gefunden. Es geht um die Funktion col_url der Komponente Scheduled Task Handler. Durch Beeinflussen des Arguments cjurl mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-14T08:02:06.148Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-323830 | Magicblack MacCMS Scheduled Task col_url server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.323830"
},
{
"name": "VDB-323830 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.323830"
},
{
"name": "Submit #645798 | magicblack MacCMSv10 v2025.1000.4050 SSRF",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.645798"
},
{
"tags": [
"related"
],
"url": "https://github.com/August829/Yu/blob/main/58ead8e7e08bfb017.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-09-13T17:22:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Magicblack MacCMS Scheduled Task col_url server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-10395",
"datePublished": "2025-09-14T08:02:06.148Z",
"dateReserved": "2025-09-13T15:16:57.200Z",
"dateUpdated": "2025-09-15T20:11:53.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-116216 (GCVE-0-2026-116216)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-11-02 17:35
VLAI
EPSS
VEX
Title
MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment
Summary
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:35 UTC
CWE
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maccmspro/maccms10/issues/30 | issue-tracking |
| https://github.com/maccmspro/maccms10/blob/7f388e… | technical-description |
| https://github.com/maccmspro/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-t… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| maccmspro | maccms10 |
Affected:
0 , ≤ 2021.1000.2000
(custom)
|
|
| magicblack | maccms10 |
Affected:
0 , ≤ 2026.1000.4056
(custom)
|
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116216",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:35:05.344140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:35:24.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "maccmspro",
"versions": [
{
"lessThanOrEqual": "2021.1000.2000",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "2026.1000.4056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Raihan Biswas"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member\u0027s avatar and impersonating them."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:08:48.563Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #30",
"tags": [
"issue-tracking"
],
"url": "https://github.com/maccmspro/maccms10/issues/30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/index/controller/Comment.php#L37-L95"
},
{
"tags": [
"product"
],
"url": "https://github.com/maccmspro/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-comment-impersonation-via-user-id-mass-assignment"
}
],
"title": "MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116216",
"datePublished": "2026-10-26T13:08:48.563Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-11-02T17:35:24.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116215 (GCVE-0-2026-116215)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-10-31 01:20
VLAI
EPSS
VEX
Title
MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption
Summary
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-31 01:20 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/maccmspro/maccms10/issues/30 | issue-tracking |
| https://github.com/maccmspro/maccms10/blob/7f388e… | technical-description |
| https://github.com/maccmspro/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-t… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| maccmspro | maccms10 |
Affected:
0 , ≤ 2021.1000.2000
(custom)
|
|
| magicblack | maccms10 |
Affected:
0 , ≤ 2026.1000.4056
(custom)
|
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-31T01:20:20.915628Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T01:20:31.938Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "maccmspro",
"versions": [
{
"lessThanOrEqual": "2021.1000.2000",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "2026.1000.4056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Raihan Biswas"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:08:47.862Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #30",
"tags": [
"issue-tracking"
],
"url": "https://github.com/maccmspro/maccms10/issues/30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/Card.php#L123-L160"
},
{
"tags": [
"product"
],
"url": "https://github.com/maccmspro/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-race-condition-via-card-redemption"
}
],
"title": "MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116215",
"datePublished": "2026-10-26T13:08:47.862Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-10-31T01:20:31.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116214 (GCVE-0-2026-116214)
Vulnerability from cvelistv5 – Published: 2026-10-26 13:08 – Updated: 2026-11-04 20:39
VLAI
EPSS
VEX
Title
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
Summary
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:39 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/maccmspro/maccms10/issues/30 | issue-tracking |
| https://github.com/maccmspro/maccms10/blob/7f388e… | technical-description |
| https://github.com/magicblack/maccms10/commit/27b… | patch |
| https://github.com/maccmspro/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-b… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| maccmspro | maccms10 |
Affected:
0 , ≤ 2021.1000.2000
(custom)
|
|
| magicblack | maccms10 |
Affected:
0 , < 2026.1000.4054
(custom)
|
Date Public
2026-10-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-116214",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:39:36.839775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:39:45.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "maccmspro",
"versions": [
{
"lessThanOrEqual": "2021.1000.2000",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThan": "2026.1000.4054",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abu Raihan Biswas"
}
],
"datePublic": "2026-10-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member\u0027s password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim\u0027s email or phone to take over the account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T13:08:47.141Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #30",
"tags": [
"issue-tracking"
],
"url": "https://github.com/maccmspro/maccms10/issues/30"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/maccmspro/maccms10/blob/7f388ee0008faf5b01e5df7bf5e5a6ff4bbe13e8/application/common/model/User.php#L607-L630"
},
{
"name": "Fix Commit (magicblack/maccms10)",
"tags": [
"patch"
],
"url": "https://github.com/magicblack/maccms10/commit/27bb1b004b9931c93f46b65e9c0e531466e7e02a"
},
{
"tags": [
"product"
],
"url": "https://github.com/maccmspro/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-before-2026.1000.4054-account-takeover-via-unbound-password-recovery-code"
}
],
"title": "MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-116214",
"datePublished": "2026-10-26T13:08:47.141Z",
"dateReserved": "2026-10-25T12:28:44.091Z",
"dateUpdated": "2026-11-04T20:39:45.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111356 (GCVE-0-2026-111356)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 16:49
VLAI
EPSS
VEX
Title
MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
Summary
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:49 UTC
CWE
- CWE-307 - Improper Restriction of Excessive Authentication Attempts
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/maccms10-passwor… | third-party-advisory |
| https://github.com/magicblack/maccms10/blob/v2026… | technical-description |
| https://github.com/magicblack/maccms10/blob/v2026… | technical-description |
| https://github.com/magicblack/maccms10 | product |
| https://www.vulncheck.com/advisories/maccms-v10-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| magicblack | MacCMS |
Affected:
0 , ≤ 2026.1000.4056
(custom)
cpe:2.3:a:maccms:maccms:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111356",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:49:26.985761Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:49:52.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/maccms10-password-reset-code-brute-force-account-takeover"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/magicblack/maccms10",
"product": "MacCMS",
"repo": "https://github.com/magicblack/maccms10",
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "2026.1000.4056",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:maccms:maccms:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2026.1000.4056",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim\u0027s email or phone can request a code and brute-force findpass_reset to overwrite the member\u0027s password."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:45.212Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/maccms10-password-reset-code-brute-force-account-takeover"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1199-L1231"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1397-L1450"
},
{
"tags": [
"product"
],
"url": "https://github.com/magicblack/maccms10"
},
{
"name": "VulnCheck Advisory: MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-account-takeover-via-password-recovery-brute-force"
}
],
"title": "MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111356",
"datePublished": "2026-10-15T21:43:45.212Z",
"dateReserved": "2026-10-15T20:56:53.414Z",
"dateUpdated": "2026-10-16T16:49:52.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90788 (GCVE-0-2026-90788)
Vulnerability from cvelistv5 – Published: 2026-09-14 14:00 – Updated: 2026-09-16 15:05
VLAI
EPSS
VEX
Title
magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection
Summary
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 15:05 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/403294 | vdb-entry |
| https://vuldb.com/vuln/403294/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-90788 | third-party-advisory |
| https://vuldb.com/submit/919268 | third-party-advisory |
| https://github.com/magicblack/maccms10/issues/1378 | exploitissue-tracking |
| https://github.com/magicblack/maccms10/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| magicblack | MacCMS10 |
Affected:
2026.1000.4055
cpe:2.3:a:magicblack:maccms10:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90788",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T15:05:14.422569Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:05:33.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:magicblack:maccms10:*:*:*:*:*:*:*:*"
],
"modules": [
"Template Handler"
],
"product": "MacCMS10",
"vendor": "magicblack",
"versions": [
{
"status": "affected",
"version": "2026.1000.4055"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "seikruun (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T14:00:09.959Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-403294 | magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/403294"
},
{
"name": "VDB-403294 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/403294/cti"
},
{
"name": "CVE-2026-90788 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-90788"
},
{
"name": "Submit #919268 | MacCMS MacCMS10 maccms10-2026.1000.4055 OS Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/919268"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/magicblack/maccms10/issues/1378"
},
{
"tags": [
"product"
],
"url": "https://github.com/magicblack/maccms10/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-13T15:17:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-90788",
"datePublished": "2026-09-14T14:00:09.959Z",
"dateReserved": "2026-09-13T13:12:14.654Z",
"dateUpdated": "2026-09-16T15:05:33.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71232 (GCVE-0-2026-71232)
Vulnerability from cvelistv5 – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:45
VLAI
EPSS
VEX
Title
MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
Summary
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 12:53 UTC
CWE
- CWE-94 - Code Injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/magicblack/maccms10/commit/71a… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| magicblack | maccms10 |
Affected:
0 , ≤ 10
(custom)
|
Date Public
2026-08-05 10:56
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71232",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T12:53:18.041904Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:53:53.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "maccms10",
"programFiles": [
"application/admin/controller/Template.php"
],
"vendor": "magicblack",
"versions": [
{
"lessThanOrEqual": "10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mirdavlatov Mira\u0027zam"
}
],
"datePublic": "2026-08-05T10:56:15.883Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMacCMS10\u0027s admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.\u003c/p\u003e"
}
],
"value": "MacCMS10\u0027s admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:45:29.873Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/magicblack/maccms10/commit/71ad3bb29570e110d8e973acff68040a3050ddf0"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71232",
"datePublished": "2026-08-05T10:56:15.883Z",
"dateReserved": "2026-08-05T10:53:53.175Z",
"dateUpdated": "2026-08-10T11:45:29.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-10397 (GCVE-0-2025-10397)
Vulnerability from cvelistv5 – Published: 2025-09-14 11:02 – Updated: 2025-09-15 20:13
VLAI
EPSS
VEX
Title
Magicblack MacCMS API server-side request forgery
Summary
A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-15 20:13 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.323832 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.323832 | signaturepermissions-required |
| https://vuldb.com/?submit.645805 | third-party-advisory |
| https://github.com/August829/Yu/blob/main/58ead8e… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Magicblack | MacCMS |
Affected:
2025.1000.4050
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10397",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T20:13:05.040214Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T20:13:17.742Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"API Handler"
],
"product": "MacCMS",
"vendor": "Magicblack",
"versions": [
{
"status": "affected",
"version": "2025.1000.4050"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yu Bao (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in Magicblack MacCMS 2025.1000.4050 gefunden. Es geht dabei um eine nicht klar definierte Funktion der Komponente API Handler. Die Ver\u00e4nderung des Parameters cjurl resultiert in server-side request forgery. Der Angriff kann \u00fcber das Netzwerk passieren. Die Schwachstelle wurde \u00f6ffentlich offengelegt und k\u00f6nnte ausgenutzt werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-14T11:02:05.683Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-323832 | Magicblack MacCMS API server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.323832"
},
{
"name": "VDB-323832 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.323832"
},
{
"name": "Submit #645805 | magicblack MacCMSv10 v2025.1000.4050 SSRF",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.645805"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/August829/Yu/blob/main/58ead8e7e08bfb018.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-09-13T19:34:25.000Z",
"value": "VulDB entry last update"
}
],
"title": "Magicblack MacCMS API server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-10397",
"datePublished": "2025-09-14T11:02:05.683Z",
"dateReserved": "2025-09-13T17:29:22.553Z",
"dateUpdated": "2025-09-15T20:13:17.742Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-10395 (GCVE-0-2025-10395)
Vulnerability from cvelistv5 – Published: 2025-09-14 08:02 – Updated: 2025-09-15 20:11
VLAI
EPSS
VEX
Title
Magicblack MacCMS Scheduled Task col_url server-side request forgery
Summary
A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-15 20:11 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.323830 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.323830 | signaturepermissions-required |
| https://vuldb.com/?submit.645798 | third-party-advisory |
| https://github.com/August829/Yu/blob/main/58ead8e… | related |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Magicblack | MacCMS |
Affected:
2025.1000.4050
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T20:11:34.882549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T20:11:53.663Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Scheduled Task Handler"
],
"product": "MacCMS",
"vendor": "Magicblack",
"versions": [
{
"status": "affected",
"version": "2025.1000.4050"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Yu Bao (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely."
},
{
"lang": "de",
"value": "In Magicblack MacCMS 2025.1000.4050 wurde eine Schwachstelle gefunden. Es geht um die Funktion col_url der Komponente Scheduled Task Handler. Durch Beeinflussen des Arguments cjurl mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-14T08:02:06.148Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-323830 | Magicblack MacCMS Scheduled Task col_url server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.323830"
},
{
"name": "VDB-323830 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.323830"
},
{
"name": "Submit #645798 | magicblack MacCMSv10 v2025.1000.4050 SSRF",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.645798"
},
{
"tags": [
"related"
],
"url": "https://github.com/August829/Yu/blob/main/58ead8e7e08bfb017.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-09-13T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-09-13T17:22:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "Magicblack MacCMS Scheduled Task col_url server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-10395",
"datePublished": "2025-09-14T08:02:06.148Z",
"dateReserved": "2025-09-13T15:16:57.200Z",
"dateUpdated": "2025-09-15T20:11:53.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}