maccmspro vulnerabilities

Products

• maccms10 3

Latest maccmspro CVEs

Newest publication first

1. CVE-2026-116216 MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment

   Published 2026-10-26

   Medium·CVSS 6.9 EPSS 0.27%

   MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attrib...

2. CVE-2026-116215 MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption

   Published 2026-10-26

   Low·CVSS 2.3 EPSS 0.16%

   MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking car...

3. CVE-2026-116214 MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

   Published 2026-10-26

   Critical·CVSS 9.3 EPSS 0.46%

   MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.