Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Maccms
(Maccms)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 27 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2022-03-25 | CVE-2022-27887 | Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter. | Maccms | 6.1 | ||
| 2022-03-16 | CVE-2021-45787 | There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks. | Maccms | 5.4 | ||
| 2022-03-16 | CVE-2021-45786 | In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges. | Maccms | 9.8 | ||
| 2021-10-04 | CVE-2020-21386 | A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges. | Maccms | 8.8 | ||
| 2021-10-04 | CVE-2020-21387 | A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload. | Maccms | 6.1 | ||
| 2021-10-04 | CVE-2020-21434 | Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field. | Maccms | 5.4 | ||
| 2021-09-24 | CVE-2020-20514 | A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users. | Maccms | 8.1 | ||
| 2021-09-14 | CVE-2020-21081 | A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL. | Maccms | 6.5 | ||
| 2021-09-14 | CVE-2020-21082 | A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and user cookies via crafted payloads in the text fields for Chinese and English names. | Maccms | 6.1 | ||
| 2021-08-11 | CVE-2020-21359 | An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name. | Maccms | 9.8 |