Vulnerabilities

TI-2025-40916 CVE-2025-66492

Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter

LOW 35

Masa CMS is an open source Enterprise Content Management platform.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.0025 Published 2025-12-12 Fixed in 7.2.9, 7.3.14 +2 CWE-79

TI-2024-21525 CVE-2024-32643

HIGH 66

Masa CMS is an open source Enterprise Content Management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00389 Published 2025-12-03 Fixed in 7.4.6, 7.3.13 +1 CWE-863

TI-2024-21524 CVE-2024-32642

HIGH 71

Masa CMS is an open source Enterprise Content Management platform.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00215 Published 2025-12-03 Fixed in 7.4.6, 7.3.13 +1 CWE-346

TI-2024-21523 CVE-2024-32641

HIGH 82

Masa CMS is an open source Enterprise Content Management platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.13144 Published 2025-12-03 Fixed in 7.4.6, 7.3.13 +1 CWE-94

TI-2022-23274 CVE-2022-47002 · GHSA-8m42-x386-j52h

MEDIUM 51

A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06253 Published 2023-02-01 No fix listed CWE-863

TI-2021-18659 CVE-2021-42183 · GHSA-qwpm-6h36-f4f8

MEDIUM 40

MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04695 Published 2022-05-05 No fix listed CWE-22