Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: magicblack Clear all filters
TI-2026-80390 CVE-2026-116216 · GHSA-9f7c-9m42-3x6j

Mass assignment in MacCMS lets anonymous comments impersonate users

Priority LOW 36

MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00271 Published 2026-10-26 No fix listed CWE-915
TI-2026-80389 CVE-2026-116215 · GHSA-m463-2mww-7vjr

Race condition in MacCMS lets members reuse recharge cards

Priority LOW 11

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00164 Published 2026-10-26 No fix listed CWE-362
TI-2026-80388 CVE-2026-116214 · GHSA-x697-8hfh-c2rc

Password recovery flaw in MacCMS v10 allows account takeover

Priority MEDIUM 48

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00458 Published 2026-10-26 Fixed in 2026.1000.4054 CWE-640
TI-2026-75090 CVE-2026-111356

Password recovery brute-force in MacCMS allows account takeover

Priority HIGH 74

MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00448 Published 2026-10-15 No fix listed CWE-307
TI-2026-49903 CVE-2026-71232 · GHSA-cv48-22qx-mpmx

MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

Priority LOW 34

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0054 Published 2026-08-05 No fix listed CWE-94