jackq vulnerabilities

Products

• xcms 1

Latest jackq CVEs

Newest publication first

1. CVE-2026-108799 jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection

   Published 2026-10-12

   Medium·CVSS 6.9

   A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.