CVE-2026-111356: falha crítica em magicblack MacCMS
MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 0.4%
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
magicblack · MacCMSReferências
https://github.com/magicblack/maccms10https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1199-L1231https://github.com/magicblack/maccms10/blob/v2026.1000.4056/application/common/model/User.php#L1397-L1450https://hackmd.io/@hieuPenguinnn/maccms10-password-reset-code-brute-force-account-takeoverhttps://www.vulncheck.com/advisories/maccms-v10-through-2026.1000.4056-account-takeover-via-password-recovery-brute-force