MasaCMS vulnerabilities
We track 11 vulnerabilities in MasaCMS products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on May 6, 2026.
Latest MasaCMS vulnerabilities
- 7.1 High severity
MasaCMS: Cross-Site Request Forgery
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the createBundle method in `csettings.cfc` does not properly validate anti-CSRF tokens for site bundle creation requests. An attacker can craft a malicious webpage or
- 8.7 High severity
MasaCMS: Cross-Site Request Forgery
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the `cTrash.restore` function does not properly validate anti-CSRF tokens for content restoration requests. An attacker can trick a logged-in administrator to submit a
- 7.2 High severity
MasaCMS: Cross-Site Request Forgery
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cTrash.empty function does not validate anti-CSRF tokens for trash management requests. An attacker can induce a logged-in administrator to submit a forged request
- 7.1 High severity
MasaCMS: Cross-Site Request Forgery
Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cUsers.updateAddress function does not properly validate anti-CSRF tokens for user address management operations. An attacker can induce a logged-in administrator
- 9.3 Critical severity
MasaCMS: Improper Neutralization of Special Elements used in an SQL Command
Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, the unauthenticated JSON API accepts an altTable parameter that is stored via the setAltTable() method wi
- 9.3 Critical severity
MasaCMS: Improper Neutralization of Special Elements used in an SQL Command
Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handlin
- 9.3 Critical severity
MasaCMS: Improper Neutralization of Special Elements used in an SQL Command
Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitiz
- 7.5 High severity
MasaCMS: Incorrect Authorization
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed
- 8.8 High severity
MasaCMS: Origin Validation Error
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
- 9.8 Critical severity
MasaCMS: Improper Control of Generation of Code
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria paramet
- 9.8 Critical severity
MasaCMS: Improper Neutralization of Special Elements used in an SQL Command
MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.5,