Skip to content
OpenAdvisories

Vendor

magicblack

8 known vulnerabilities.

Products

MacCMS10 5 MacCMS 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    CVE-2026-111356

    MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force

    MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset t…

    magicblack MacCMS
  • High 7.2
    CVE-2026-71232

    MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE

    MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, r…

    magicblack MacCMS10