Maccms
Maccms · 37 CVEs
MacCMS Member Order Detail User.php order_info authorization
Mar 22, 2026
MacCMS Timming API Endpoint Timming.php weak authentication
Mar 22, 2026
Magicblack MacCMS API server-side request forgery
Sep 14, 2025
Magicblack MacCMS Scheduled Task col_url server-side request forgery
Sep 14, 2025
Maccms10 Database.php rep sql injection
Sep 9, 2025
maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.
May 29, 2025
maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.
May 27, 2025
maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
Mar 28, 2025
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.
Mar 28, 2025
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
Mar 28, 2025
A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows a…
Sep 20, 2024
Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code v…
Apr 19, 2024
A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbi…
Feb 1, 2023
A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary…
Jan 6, 2023
maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table param…
Aug 17, 2022
maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
Jun 21, 2022
maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
Jun 21, 2022
Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.
Mar 31, 2022
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.…
Mar 25, 2022
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/inde…
Mar 25, 2022
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/…
Mar 25, 2022
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/inde…
Mar 25, 2022
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/…
Mar 25, 2022
There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserte…
Mar 16, 2022
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privil…
Mar 16, 2022
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-4563 | MacCMS Member Order Detail User.php order_info authorization | MEDIUM | 0.37% | Mar 22, 2026 |
| CVE-2026-4562 | MacCMS Timming API Endpoint Timming.php weak authentication | MEDIUM | 0.65% | Mar 22, 2026 |
| CVE-2025-10397 | Magicblack MacCMS API server-side request forgery | MEDIUM | 0.34% | Sep 14, 2025 |
| CVE-2025-10395 | Magicblack MacCMS Scheduled Task col_url server-side request forgery | MEDIUM | 0.34% | Sep 14, 2025 |
| CVE-2025-10122 | Maccms10 Database.php rep sql injection | MEDIUM | 0.33% | Sep 9, 2025 |
| CVE-2025-45474 | maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings. | HIGH | 0.37% | May 29, 2025 |
| CVE-2025-45475 | maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management. | MEDIUM | 0.33% | May 27, 2025 |
| CVE-2025-28091 | maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article. | CRITICAL | 0.44% | Mar 28, 2025 |
| CVE-2025-28090 | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature. | CRITICAL | 0.43% | Mar 28, 2025 |
| CVE-2025-28089 | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function. | CRITICAL | 0.44% | Mar 28, 2025 |
| CVE-2024-46654 | A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web script… | MEDIUM | 0.25% | Sep 20, 2024 |
| CVE-2024-32391 | Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload. | HIGH | 0.92% | Apr 19, 2024 |
| CVE-2022-47872 | A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload inj… | HIGH | 0.87% | Feb 1, 2023 |
| CVE-2022-44870 | A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… | MEDIUM | 0.50% | Jan 6, 2023 |
| CVE-2022-35148 | maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html. | MEDIUM | 0.69% | Aug 17, 2022 |
| CVE-2022-31303 | maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. | MEDIUM | 0.43% | Jun 21, 2022 |
| CVE-2022-31302 | maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. | MEDIUM | 0.43% | Jun 21, 2022 |
| CVE-2021-43707 | Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter. | MEDIUM | 0.64% | Mar 31, 2022 |
| CVE-2022-27887 | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter. | MEDIUM | 0.56% | Mar 25, 2022 |
| CVE-2022-27886 | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter. | MEDIUM | 0.56% | Mar 25, 2022 |
| CVE-2022-27885 | Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and inp… | MEDIUM | 0.56% | Mar 25, 2022 |
| CVE-2022-27884 | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter. | MEDIUM | 0.56% | Mar 25, 2022 |
| CVE-2022-26573 | Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input p… | MEDIUM | 0.57% | Mar 25, 2022 |
| CVE-2021-45787 | There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name… | MEDIUM | 0.46% | Mar 16, 2022 |
| CVE-2021-45786 | In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges. | CRITICAL | 1.20% | Mar 16, 2022 |
Showing 1 to 25 of 37 CVEs