Vulnerabilities in MasaCMS
13 resultsVexday analysis
MasaCMS apresenta 13 vulnerabilidades catalogadas, com 8 publicadas nos últimos 90 dias, indicando ciclo ativo de descobertas. Embora 5 sejam críticas, nenhuma está sob exploração conhecida (KEV=0), reduzindo o risco imediato. A fraqueza dominante é falsificação de requisição entre sites (CWE-352), típica de falhas de validação que requerem atenção em ambientes de produção.
CVE-2024-32640CRITICALMasaCMS SQL Injection vulnerabilityEPSS 70.2%CVE-2024-32641CRITICALMasa CMS Vulnerable to Pre-Auth RCE via JSON APIEPSS 12.3%CVE-2026-40330CRITICALMasa CMS SQL injection via sortDirection parameter in beanFeedEPSS 0.4%CVE-2024-32643HIGHMasa CMS vulnerable to authentication bypass with /tag/EPSS 0.4%CVE-2026-40332MEDIUMMasa CMS open redirect via improper handling of scheme-relative URLsEPSS 0.3%CVE-2026-40331CRITICALMasa CMS unauthenticated SQL injection via altTable parameter in JSON APIEPSS 0.3%CVE-2026-40329CRITICALSQL Injection vulnerability via sortBy in beanFeedEPSS 0.3%CVE-2025-66492HIGHMasa CMS vulnerable to Cross-Site Scripting (XSS) through URL ParameterEPSS 0.2%CVE-2024-32642HIGHHost header poisoning allows account takeover via password reset emailEPSS 0.2%CVE-2026-40174HIGHMasa CMS CSRF in user address management allows unauthorized address changesEPSS 0.2%CVE-2026-40309HIGHMasa CMS CSRF in trash management allows unauthorized permanent deletion of deleted contentEPSS 0.2%CVE-2026-40326HIGHMasa CMS CSRF in site bundle creation allows unauthorized site data exportEPSS 0.2%CVE-2026-40325HIGHMasa CMS CSRF in content restoration allows unauthorized restoration of deleted contentEPSS 0.2%