MacCMS vulnerabilities

CVEs whose affected-version data names the MacCMS package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111356High· 7.4

yesterday

MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force

MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-…

▾ Twilightmagicblack · MacCMSvia CVEORG