Vulnerabilidades de Magicblack
CVEs publicadas que afetam produtos de Magicblack: 3 registro(s), com severidade, exploração e correções.
CVE-2026-111356
Alta · 7.4
CWE-307 15/10/2026
MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
CVE-2026-90788
Média · 4.7
CWE-77 14/09/2026
magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-71232
Alta · 7.2
CWE-94 05/08/2026
MacCMS10 - Incomplete Function Blacklist in Template Editor Enables Authenticated RCE
MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.