GCVE - cpe:2.3:a:maccms:maccms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:maccms:maccms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Maccms (`4c8db01f-ae7a-5d5d-a25a-ca3630c33235`)
Product	Maccms (`17694d10-9d21-59f4-aed9-880b58688cd1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/daicuo/maccms`	purl2cpe	2026-06-01 10:17:56.026718
`pkg:github/magicblack/maccms10`	purl2cpe	2026-06-01 10:17:56.026722

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-4563`	vulnerable	2026-06-08 08:05:13.533610	MacCMS Member Order Detail User.php order_info authorization MEDIUM (4.3) A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function order_info of the file application/index/controller/User.php of the component Member Order Detail Interface. This manipulation of the argument order_id causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Published: 2026-03-22T23:51:03.216Z Updated: 2026-03-25T13:53:02.294Z Open on db.gcve.eu Reference links https://vuldb.com/?id.352400 https://vuldb.com/?ctiid.352400 https://vuldb.com/?submit.775050 https://github.com/HuajiHD/CVE/issues/10	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-4562`	vulnerable	2026-06-08 08:05:13.533221	MacCMS Timming API Endpoint Timming.php weak authentication HIGH (7.3) A security flaw has been discovered in MacCMS 2025.1000.4052. This affects an unknown part of the file application/api/controller/Timming.php of the component Timming API Endpoint. The manipulation results in missing authentication. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Published: 2026-03-22T23:09:08.900Z Updated: 2026-03-23T11:56:22.907Z Open on db.gcve.eu Reference links https://vuldb.com/?id.352399 https://vuldb.com/?ctiid.352399 https://vuldb.com/?submit.775039 https://github.com/HuajiHD/CVE/issues/9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-46654`	vulnerable	2026-06-08 06:48:10.237523	Details available A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Published: 2024-09-20T00:00:00.000Z Updated: 2024-09-20T19:53:17.401Z Open on db.gcve.eu Reference links https://github.com/magicblack/maccms10/issues/1183	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-8410`	vulnerable	2026-06-08 05:14:24.099377	Details available Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key). Published: 2019-02-27T17:00:00.000Z Updated: 2024-08-04T21:17:31.436Z Open on db.gcve.eu Reference links https://github.com/holychang/maccms8/blob/master/xss2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-19465`	vulnerable	2026-06-08 05:11:15.774716	Details available Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, related to template/paody/html/vod_index.html. Published: 2019-06-07T16:40:51.000Z Updated: 2024-08-05T11:37:11.357Z Open on db.gcve.eu Reference links https://www.maccms.com/down.html https://github.com/holychang/maccms8/blob/master/README.md	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Maccms

Notes

PURL mappings

Vulnerability references

Contribute