Approved changes feed: RSS · Atom
cpe:2.3:a:maccmspro:maccms10:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Maccmspro (7bc7bb15-df1d-52a7-bc4b-20ff6d1e1484) |
|---|---|
| Product | Maccms10 (165e3371-59c0-512a-889d-26b01258316e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-116214 |
vulnerable | 2026-11-03 10:15:22.028471 |
MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code
CRITICAL (9.1)
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.
Published: 2026-10-26T13:08:47.141Z
Updated: 2026-11-04T20:39:45.870Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116215 |
vulnerable | 2026-11-03 10:15:21.682163 |
MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption
LOW (3.1)
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.
Published: 2026-10-26T13:08:47.862Z
Updated: 2026-10-31T01:20:31.938Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-116216 |
vulnerable | 2026-11-03 10:15:21.411950 |
MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment
MEDIUM (5.3)
MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows unauthenticated attackers to set arbitrary mac_comment columns including user_id. Attackers can submit anonymous comments with a crafted user_id parameter to attribute them to any registered member, displaying that member's avatar and impersonating them.
Published: 2026-10-26T13:08:48.563Z
Updated: 2026-11-02T17:35:24.018Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.