Read the docs

maccmspro

Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

maccmspro records in CISA KEV

No maccmspro vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-80388 CVE-2026-116214 · GHSA-x697-8hfh-c2rc

Password recovery flaw in MacCMS v10 allows account takeover

Priority MEDIUM 48

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00458 Published 2026-10-26 Fixed in 2026.1000.4054 CWE-640
TI-2026-80390 CVE-2026-116216 · GHSA-9f7c-9m42-3x6j

Mass assignment in MacCMS lets anonymous comments impersonate users

Priority LOW 36

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00271 Published 2026-10-26 No fix listed CWE-915
TI-2026-80389 CVE-2026-116215 · GHSA-m463-2mww-7vjr

Race condition in MacCMS lets members reuse recharge cards

Priority LOW 11

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00164 Published 2026-10-26 No fix listed CWE-362
Open these records in search →