A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges.
CVSS Score
8.8
EPSS Score
0.002
Published
2021-10-04
A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload.
CVSS Score
6.1
EPSS Score
0.002
Published
2021-10-04
A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.
CVSS Score
8.1
EPSS Score
0.001
Published
2021-09-24
An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name.
CVSS Score
9.8
EPSS Score
0.011
Published
2021-08-11
A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter.
CVSS Score
5.4
EPSS Score
0.002
Published
2021-08-11
An arbitrary file deletion vulnerability exists within Maccms10.
CVSS Score
6.5
EPSS Score
0.004
Published
2021-08-11
Maccms 10 allows remote attackers to execute arbitrary PHP code by entering this code in a template/default_pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.
CVSS Score
8.8
EPSS Score
0.007
Published
2019-03-15
Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.
CVSS Score
8.8
EPSS Score
0.005
Published
2018-06-14
Page 3