CVE-2026-124575mediumCWE-307CWE-799

CVE-2026-124575: falha de média gravidade em SiteServer SSCMS

SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication

Publicada em

Seguir esta CVE+ Monitorar SSCMS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

10Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3
A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Produtos afetados
SiteServer · SSCMS
CVEs relacionadas — SiteServer SSCMS

No mesmo produto, das mais perigosas para as menos.

CVE-2026-82486LOWSiteServer SSCMS Agent Installation Workflow access controlEPSS 0.3%CVE-2026-111658MEDIUMSiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels APIEPSS 0.3%