Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19 results
Oct 26, 2026MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mCVE-2026-116216 · Other software · maccmspro · reported by VulnCheckMedium 6.9
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiCVE-2026-116215 · Other software · maccmspro · reported by VulnCheckLow 2.3
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because chCVE-2026-116214 · Other software · maccmspro · reported by VulnCheckCritical 9.3
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055.CVE-2026-90788 · Other software · magicblack · reported by VulDBLow 2
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- MacCMS10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 5, 2026MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the bCVE-2026-71232 · Other software · magicblack · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.2
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.
- Product
- maccms10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025A vulnerability was found in Maccms10 2025.1000.4050.CVE-2025-10122 · Other software · Maccms · reported by VulDBLow 2
A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulation of the argument where results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.CVE-2025-45474 · Other software · Maccms · reported by MITREHigh 7.3
maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.CVE-2025-45475 · Other software · Maccms · reported by MITREMedium 5.4
maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.CVE-2025-28091 · Other software · Maccms · reported by MITRECritical 9.1
maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.CVE-2025-28090 · Other software · Maccms · reported by MITRECritical 9.1
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2025maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.CVE-2025-28089 · Other software · Maccms · reported by MITRECritical 9.1
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 20, 2024A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web scriptsCVE-2024-46654 · Other software · maccms · reported by MITREMedium 4.8
A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2023A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injeCVE-2022-47872 · Other software · Maccms · reported by MITREHigh 8.8
A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload injected into the Name parameter under the Interface address module.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2023A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2022-44870 · Other software · Maccms · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 17, 2022maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html.CVE-2022-35148 · Other software · Maccms · reported by MITREMedium 6.5
maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2022maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.CVE-2022-31303 · Other software · Maccms · reported by MITREMedium 5.4
maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021An arbitrary file deletion vulnerability exists within Maccms10.CVE-2020-21363 · Other software · Maccms · reported by MITREMedium 6.5
An arbitrary file deletion vulnerability exists within Maccms10.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' CVE-2020-21362 · Other software · Maccms · reported by MITREMedium 5.4
A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrarCVE-2020-21359 · Other software · Maccms · reported by MITRECritical 9.8
An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name.
- Product
- Maccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.