Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: maccmspro Clear all filters
TI-2026-80390 CVE-2026-116216 · GHSA-9f7c-9m42-3x6j

Mass assignment in MacCMS lets anonymous comments impersonate users

Priority LOW 36

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00271 Published 2026-10-26 No fix listed CWE-915
TI-2026-80389 CVE-2026-116215 · GHSA-m463-2mww-7vjr

Race condition in MacCMS lets members reuse recharge cards

Priority LOW 11

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00164 Published 2026-10-26 No fix listed CWE-362
TI-2026-80388 CVE-2026-116214 · GHSA-x697-8hfh-c2rc

Password recovery flaw in MacCMS v10 allows account takeover

Priority MEDIUM 48

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00458 Published 2026-10-26 Fixed in 2026.1000.4054 CWE-640