Skip to content
Noroxi

maccms records

37 published records for vendor maccms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

37 records
  • CVE-2017-17733
    52Plan

    Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.

    CriticalCVSS 9.8No exploitEPSS 44%

    maccms · maccmsDec 18, 2017

  • CVE-2020-21359
    40Plan

    An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification

    CriticalCVSS 9.8No exploitEPSS 2%

    maccms · maccmsAug 11, 2021

  • CVE-2021-45786
    39Monitor

    In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.

    CriticalCVSS 9.8No exploitEPSS 1%

    maccms · maccmsMar 16, 2022

  • CVE-2018-12114
    36Monitor

    Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.

    HighCVSS 8.8Proof of conceptEPSS 3%

    maccms · maccmsJun 14, 2018

  • CVE-2019-9829
    36Monitor

    Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action.

    HighCVSS 8.8No exploitEPSS 2%

    maccms · maccmsMar 14, 2019

  • CVE-2025-28089
    36Monitor

    maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.

    CriticalCVSS 9.1No exploitEPSS 0%

    maccms · maccmsMar 28, 2025

  • CVE-2025-28091
    36Monitor

    maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.

    CriticalCVSS 9.1No exploitEPSS 0%

    maccms · maccmsMar 28, 2025

  • CVE-2025-28090
    36Monitor

    maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.

    CriticalCVSS 9.1No exploitEPSS 0%

    maccms · maccmsMar 28, 2025

  • CVE-2022-47872
    35Monitor

    A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a

    HighCVSS 8.8Proof of conceptEPSS 1%

    maccms · maccmsFeb 1, 2023

  • CVE-2020-21386
    35Monitor

    A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator priv

    HighCVSS 8.8No exploitEPSS 0%

    maccms · maccmsOct 4, 2021

  • CVE-2020-20514
    32Monitor

    A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all u

    HighCVSS 8.1No exploitEPSS 0%

    maccms · maccmsSep 24, 2021

  • CVE-2024-32391
    29Monitor

    Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.

    HighCVSS 7.3No exploitEPSS 1%

    maccms · maccmsApr 19, 2024

  • CVE-2025-45474
    29Monitor

    maccms10 v2025.1000.4047 is vulnerable to Server-side request forgery (SSRF) in Email Settings.

    HighCVSS 7.3No exploitEPSS 0%

    maccms · maccmsMay 29, 2025

  • CVE-2020-21363
    26Monitor

    An arbitrary file deletion vulnerability exists within Maccms10.

    MediumCVSS 6.5No exploitEPSS 1%

    maccms · maccmsAug 11, 2021

  • CVE-2022-35148
    26Monitor

    maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/colu

    MediumCVSS 6.5No exploitEPSS 1%

    maccms · maccmsAug 17, 2022

  • CVE-2020-21081
    26Monitor

    A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a

    MediumCVSS 6.5No exploitEPSS 0%

    maccms · maccmsSep 14, 2021

  • CVE-2019-8410
    24Monitor

    Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords paramet

    MediumCVSS 6.1No exploitEPSS 1%

    maccms · maccmsFeb 27, 2019

  • CVE-2018-19465
    24Monitor

    Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_

    MediumCVSS 6.1No exploitEPSS 1%

    maccms · maccmsJun 7, 2019

  • CVE-2020-21082
    24Monitor

    A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal

    MediumCVSS 6.1No exploitEPSS 1%

    maccms · maccmsSep 14, 2021

  • CVE-2021-43707
    24Monitor

    Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.

    MediumCVSS 6.1No exploitEPSS 1%

    maccms · maccmsMar 31, 2022

  • CVE-2020-21387
    24Monitor

    A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and esc

    MediumCVSS 6.1No exploitEPSS 1%

    maccms · maccmsOct 4, 2021

  • CVE-2022-26573
    24Monitor

    Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the

    MediumCVSS 6.1No exploitEPSS 1%

    maccms · maccmsMar 25, 2022

  • CVE-2022-27884
    24Monitor

    Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd par

    MediumCVSS 6.1No exploitEPSS 1%

    maccms · maccmsMar 25, 2022

  • CVE-2022-27885
    24Monitor

    Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via

    MediumCVSS 6.1No exploitEPSS 1%

    maccms · maccmsMar 25, 2022

  • CVE-2022-27886
    24Monitor

    Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd par

    MediumCVSS 6.1No exploitEPSS 1%

    maccms · maccmsMar 25, 2022