jackq XCMS CVE-2026-108799

No special configuration required - the vulnerable code path is the public password-recovery (find-password) mail endpoint handled by PublicController::sendFindPwdMail, which is reachable by remote unauthenticated attackers (PR:N/UI:N) in default XCMS installations. Exploitation only requires that the password-recovery feature be exposed, which is standard for a CMS login flow. The sole practical limit on exploitation is the product's rarity (very few deployments exist) and, per the vendor's impact rating, the per-request data impact may be partial rather than full database compromise; no authentication, user interaction, or non-default setting is needed.

Signals are mixed and point to a genuine-but-low-priority issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes an easy, remote, unauthenticated, low-complexity attack with no user interaction, which on its own sounds serious; however the vendor-supplied impact metrics are only partial (VC:L/VI:L/VA:L) and the overall score is a moderate 6.9, reflecting limited per-request impact rather than full database compromise. Exploit maturity is E:P (proof-of-concept), consistent with the POC flag and the public GitHub write-up. There is NO EPSS score provided and the CVE is NOT on the CISA KEV list, so there is no evidence of active or widespread exploitation - only that exploit code exists. The dominant risk-limiting factor is not the vulnerability class (SQL injection, CWE-89, is inherently high-impact) but the product itself: XCMS by jackq is an obscure PHP CMS with negligible enterprise footprint, so real-world attack surface is minimal. Net assessment: a real, trivially-reachable SQLi worth patching for anyone running XCMS, but a low global priority driven by the product's rarity rather than by any mitigating technical control. Note one tension to verify: SQL injection commonly warrants higher confidentiality impact than the VC:L assigned by VulDB - if stacked or UNION queries are possible the true confidentiality impact may exceed the source rating.

A remote, unauthenticated attacker sends a crafted request to the XCMS password-recovery endpoint, placing SQL payload in the 'email' parameter processed by PublicController::sendFindPwdMail. Because the input is concatenated into a SQL query without sanitization, the attacker manipulates the query to read or tamper with database contents. A public proof-of-concept exists (GitHub write-up by wawyw), lowering the skill needed to reproduce the attack.