MacCMS10 vulnerabilities

2 known vulnerabilities in MacCMS10 from Magicblack. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  maccms10: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2026-116214Oct 26, 2026Maccmspro

  MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user

• 7.2 High severity

  maccms10: Improper Control of Generation of Code

  CVE-2026-71232Aug 5, 2026Magicblack

  MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, re