EUVD-2026-43258
GHSA-r7c2-xcmm-m4pr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible install endpoint requires no auth (PR:N), but AC:H reflects stated high exploit complexity; partial CIA impacts match CWE-639 scope, no scope change applies.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. Upgrading to version 2022.1000.3025 is recommended to address this issue. Upgrading the affected component is recommended.
AnalysisAI
Authorization bypass in MacCMS Pro's installation module allows remote attackers to circumvent access controls via the step5 function in the installation controller, affecting all versions through 2022.1000.3005. Exploitation is rated high-complexity (AC:H), limiting opportunistic mass exploitation, though a public proof-of-concept is available on GitHub. No CISA KEV listing at time of analysis; EPSS data was not included in the available intelligence, but POC availability elevates the practical risk above the raw CVSS score alone might suggest.
Technical ContextAI
MacCMS Pro (also tracked as maccms10) is a PHP-based content management system, primarily targeting the Chinese-language web market. The vulnerable component is the installation controller at application/install/controller/Index.php, specifically the step5 function. CWE-639 - Authorization Bypass Through User-Controlled Key - describes a root cause where the application relies on a user-supplied value (such as a key, token, or index) to make authorization decisions without adequate server-side validation. An attacker can manipulate this key to move through installation workflow steps without legitimate authorization. CPE data (cpe:2.3:a:n/a:maccms_pro:*:*:*:*:*:*:*:*) covers all versions up to the patched release. The exposed attack surface is the installation module itself, which in many deployments may remain accessible after initial setup if not explicitly removed or restricted.
RemediationAI
Upgrade MacCMS Pro to version 2022.1000.3025 or later, available at https://github.com/magicblack/maccms10/releases (page 3 of releases). This is the vendor-confirmed patched version per the CVE advisory. As a compensating control for organizations unable to patch immediately, restrict or deny web server access to the application/install/ directory path using web server rules (e.g., nginx deny all or Apache .htaccess restrictions) - this is also recommended post-installation hardening regardless of patch status, as the install module should not remain publicly accessible after initial setup. IP allowlisting the install endpoint to trusted administrative networks is an alternative with lower operational risk than full blocking. Note that blocking the install path may prevent future re-installation workflows; coordinate with operations teams before applying.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today