CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 04/10/2021 |
| CVE-2020-21387 | 中危6.1 | A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload. | 04/10/2021 |
| CVE-2020-21386 | 高危8.8 | A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges. | 04/10/2021 |
| CVE-2020-20514 | 高危8.1 | A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users. | 24/09/2021 |
| CVE-2020-21082 | 中危6.1 | A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and user cookies via crafted payloads in the text fields for Chinese and English names. | 14/09/2021 |
| CVE-2020-21081 | 中危6.5 | A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL. | 14/09/2021 |
| CVE-2020-21363 | 中危6.5 | An arbitrary file deletion vulnerability exists within Maccms10. | 11/08/2021 |
| CVE-2020-21362 | 中危5.4 | A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter. | 11/08/2021 |
| CVE-2020-21359 | 严重9.8 | An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name. | 11/08/2021 |
| CVE-2018-19465 | 中危6.1 | Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html, related to template/paody/html/vod_index.html. | 07/06/2019 |
| CVE-2019-9829 | 高危8.8 | Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates. | 15/03/2019 |
| CVE-2019-8410 | 中危6.1 | Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles the keywords parameter, and a/tpl/module/db.php only filters the t_name parameter (not t_key). | 27/02/2019 |
| CVE-2018-12114 | 高危8.8 | Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts. | 14/06/2018 |
| CVE-2017-17733 | 严重9.8 | Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request. | 18/12/2017 |