XCMS vulnerabilities

3 known vulnerabilities in XCMS from Jackq. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  XCMS: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-108799Oct 12, 2026Jackq

  A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoin

• 7.2 High severity

  XCMS: Unrestricted Upload of File with Dangerous Type

  CVE-2025-15110Dec 27, 2025Jackq

  A vulnerability has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Affected is the function Upload of the file Admin/Home/Controller/ProductImageController.class.php of the component Backend. Such manipulation of the argument File lea

• 7.3 High severity

  XCMS: Improper Access Control

  CVE-2025-15109Dec 27, 2025Jackq

  A flaw has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. This impacts an unknown function of the file Public/javascripts/admin/plupload-2.1.2/examples/upload.php. This manipulation causes unrestricted upload. It is possible to initia