Vulnerabilities

TI-2026-29107 CVE-2026-40332

Masa CMS open redirect via improper handling of scheme-relative URLs

LOW 24

Masa CMS is affected by an Open Redirect vulnerability due to improper handling of scheme-relative URLs.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00328 Published 2026-05-06 Fixed in 7.2.10, 7.3.15 +2 CWE-601

TI-2026-29103 CVE-2026-40326

Masa CMS CSRF in site bundle creation allows unauthorized site data export

LOW 30

Masa CMS is a content management system forked from Mura CMS.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00156 Published 2026-05-06 Fixed in 7.2.10, 7.3.15 +2 CWE-352

TI-2026-29102 CVE-2026-40325

Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content

MEDIUM 45

Masa CMS is a content management system forked from Mura CMS.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00151 Published 2026-05-06 Fixed in 7.2.10, 7.3.15 +2 CWE-352

TI-2026-29086 CVE-2026-40309

Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content

LOW 39

Masa CMS is a content management system forked from Mura CMS.

CVSS 4.0HIGH 7.2 Network No auth User interaction EPSS 0.00165 Published 2026-05-06 Fixed in 7.2.10, 7.3.15 +2 CWE-352

TI-2026-28988 CVE-2026-40174

Masa CMS CSRF in user address management allows unauthorized address changes

LOW 30

Masa CMS is a content management system forked from Mura CMS.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00165 Published 2026-05-06 Fixed in 7.2.10, 7.3.15 +2 CWE-352

TI-2026-29106 CVE-2026-40331

Masa CMS unauthenticated SQL injection via altTable parameter in JSON API

MEDIUM 48

Masa CMS is an open source content management system.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00317 Published 2026-05-05 No fix listed CWE-89

TI-2026-29105 CVE-2026-40330

Masa CMS SQL injection via sortDirection parameter in beanFeed

MEDIUM 48

Masa CMS is an open source content management system.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00425 Published 2026-05-05 No fix listed CWE-89

TI-2026-29104 CVE-2026-40329

SQL Injection vulnerability via sortBy in beanFeed

MEDIUM 48

Masa CMS is an open source content management system.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00302 Published 2026-05-05 Fixed in 7.2.10 CWE-89

TI-2025-40916 CVE-2025-66492

Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter

LOW 35

Masa CMS is an open source Enterprise Content Management platform.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.0025 Published 2025-12-12 Fixed in 7.2.9, 7.3.14 +2 CWE-79

TI-2024-21525 CVE-2024-32643

Masa CMS vulnerable to authentication bypass with /tag/

HIGH 66

Masa CMS is an open source Enterprise Content Management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00389 Published 2025-12-03 Fixed in 7.4.6, 7.3.13 +1 CWE-863

TI-2024-21524 CVE-2024-32642

Host header poisoning allows account takeover via password reset email

HIGH 71

Masa CMS is an open source Enterprise Content Management platform.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00215 Published 2025-12-03 Fixed in 7.4.6, 7.3.13 +1 CWE-346

TI-2024-21523 CVE-2024-32641

Masa CMS Vulnerable to Pre-Auth RCE via JSON API

HIGH 82

Masa CMS is an open source Enterprise Content Management platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.13144 Published 2025-12-03 Fixed in 7.4.6, 7.3.13 +1 CWE-94

TI-2024-21522 CVE-2024-32640

MasaCMS SQL Injection vulnerability

CRITICAL 89

MASA CMS is an Enterprise Content Management platform based on open source technology.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.78435 Published 2025-08-11 Fixed in 7.4.5, 7.3.12 +1 CWE-89

TI-2022-23274 CVE-2022-47002 · GHSA-8m42-x386-j52h

A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows…

MEDIUM 51

A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06253 Published 2023-02-01 No fix listed CWE-863

TI-2021-18659 CVE-2021-42183 · GHSA-qwpm-6h36-f4f8

MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.

MEDIUM 40

MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04695 Published 2022-05-05 No fix listed CWE-22

Vulnerabilities

Filters