MasaCMS records
6 published records for vendor masacms.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 33.3%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-863 Incorrect Authorization2
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1
- CWE-346 Origin Validation Error1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
43Plan | CVE-2024-32641No exploit | Masa CMS Vulnerable to Pre-Auth RCE via JSON APImasacms · masacms · CWE-94 | Critical9.8 | — | 13.1% | Dec 3, 2025 |
41Plan | CVE-2022-47002Proof of concept | A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web masacms · masacms · CWE-863 | Critical9.8 | — | 6.2% | Feb 1, 2023 |
35Monitor | CVE-2024-32642No exploit | Host header poisoning allows account takeover via password reset emailmasacms · masacms · CWE-346 | High8.8 | — | 0.2% | Dec 3, 2025 |
31Monitor | CVE-2021-42183Proof of concept | MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.masacms · masacms · CWE-22 | High7.5 | — | 4.6% | May 5, 2022 |
30Monitor | CVE-2024-32643No exploit | Masa CMS vulnerable to authentication bypass with /tag/masacms · masacms · CWE-863 | High7.5 | — | 0.3% | Dec 3, 2025 |
24Monitor | CVE-2025-66492No exploit | Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parametermasacms · masacms · CWE-79 | Medium6.1 | — | 0.2% | Dec 12, 2025 |
- CVE-2024-3264143Plan
Masa CMS Vulnerable to Pre-Auth RCE via JSON API
CriticalCVSS 9.8No exploitEPSS 13%masacms · masacmsDec 3, 2025
- CVE-2022-4700241Plan
A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web
CriticalCVSS 9.8Proof of conceptEPSS 6%masacms · masacmsFeb 1, 2023
- CVE-2024-3264235Monitor
Host header poisoning allows account takeover via password reset email
HighCVSS 8.8No exploitEPSS 0%masacms · masacmsDec 3, 2025
- CVE-2021-4218331Monitor
MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/.
HighCVSS 7.5Proof of conceptEPSS 4%masacms · masacmsMay 5, 2022
- CVE-2024-3264330Monitor
Masa CMS vulnerable to authentication bypass with /tag/
HighCVSS 7.5No exploitEPSS 0%masacms · masacmsDec 3, 2025
- CVE-2025-6649224Monitor
Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter
MediumCVSS 6.1No exploitEPSS 0%masacms · masacmsDec 12, 2025