Skip to content
OpenAdvisories

Vendor

jackq

3 known vulnerabilities.

Products

XCMS 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.3
    CVE-2026-108799

    jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection

    A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoi…

    jackq XCMS
  • High 7.3
    CVE-2025-15109

    jackq XCMS upload.php unrestricted upload

    A flaw has been found in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. This impacts an unknown function of the file Public/javascripts/admin/plupload-2.1.2/examples/upload.php. This manipulation causes unrestricted upload. It is possible to initi…

    jackq XCMS