CVE-2025-10397 | Medium | 4.7 | 2025-09-14 | A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument… |
CVE-2025-10395 | Medium | 4.7 | 2025-09-14 | A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler… |
CVE-2025-10122 | Medium | 4.7 | 2025-09-09 | A vulnerability was found in Maccms10 2025.1000.4050. Affected is the function rep of the file application/admin/controller/Database.php. Performing manipulati… |
CVE-2025-45474 | High | 7.3 | 2025-05-29 | maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings. |
CVE-2025-45475 | Medium | 5.4 | 2025-05-27 | maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management. |
CVE-2025-28091 | Critical | 9.1 | 2025-03-28 | maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article. |
CVE-2025-28090 | Critical | 9.1 | 2025-03-28 | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature. |
CVE-2025-28089 | Critical | 9.1 | 2025-03-28 | maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function. |
CVE-2024-46654 | Medium | 4.8 | 2024-09-20 | A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web script… |
CVE-2024-32391 | High | 7.3 | 2024-04-19 | Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload. |
CVE-2022-47872 | High | 8.8 | 2023-02-01 | A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload inj… |
CVE-2022-44870 | Medium | 6.1 | 2023-01-06 | A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2022-35148 | Medium | 6.5 | 2022-08-17 | maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html. |
CVE-2022-31303 | Medium | 5.4 | 2022-06-21 | maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. |
CVE-2022-31302 | Medium | 5.4 | 2022-06-21 | maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. |
CVE-2021-43707 | Medium | 6.1 | 2022-03-31 | Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter. |
CVE-2022-27887 | Medium | 6.1 | 2022-03-25 | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter. |
CVE-2022-27886 | Medium | 6.1 | 2022-03-25 | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter. |
CVE-2022-27885 | Medium | 6.1 | 2022-03-25 | Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and inp… |
CVE-2022-27884 | Medium | 6.1 | 2022-03-25 | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter. |
CVE-2022-26573 | Medium | 6.1 | 2022-03-25 | Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input p… |
CVE-2021-45787 | Medium | 5.4 | 2022-03-16 | There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name… |
CVE-2021-45786 | Critical | 9.8 | 2022-03-16 | In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges. |
CVE-2020-21434 | Medium | 5.4 | 2021-10-04 | Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted pa… |
CVE-2020-21387 | Medium | 6.1 | 2021-10-04 | A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges vi… |
CVE-2020-21386 | High | 8.8 | 2021-10-04 | A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges. |
CVE-2020-20514 | High | 8.1 | 2021-09-24 | A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users. |
CVE-2020-21082 | Medium | 6.1 | 2021-09-14 | A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and… |
CVE-2020-21081 | Medium | 6.5 | 2021-09-14 | A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL. |
CVE-2020-21363 | Medium | 6.5 | 2021-08-11 | An arbitrary file deletion vulnerability exists within Maccms10. |
CVE-2020-21362 | Medium | 5.4 | 2021-08-11 | A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd'… |
CVE-2020-21359 | Critical | 9.8 | 2021-08-11 | An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitra… |
CVE-2018-19465 | Medium | 6.1 | 2019-06-07 | Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, relate… |
CVE-2019-9829 | High | 8.8 | 2019-03-15 | Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because templa… |
CVE-2019-8410 | Medium | 6.1 | 2019-02-27 | Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/modul… |
CVE-2018-12114 | High | 8.8 | 2018-06-14 | Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts. |
CVE-2017-17733 | Critical | 9.8 | 2017-12-18 | Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request. |