Magicblack vulnerabilities
We track 5 vulnerabilities in Magicblack products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 26, 2026.
Latest Magicblack vulnerabilities
- 9.1 Critical severity
maccms10: Weak Password Recovery Mechanism for Forgotten Password
MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user
- 7.4 High severity
MacCMS: Improper Restriction of Excessive Authentication Attempts
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to
- 7.2 High severity
maccms10: Improper Control of Generation of Code
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, re
- 7.2 High severity
MacCMS: Server-Side Request Forgery
A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is pub
- 7.2 High severity
MacCMS: Server-Side Request Forgery
A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible