magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection (magicblack MacCMS10)
En bref
- Source
- NVD
- EPSS
- EPSS 2.18 % · centile 82 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- VulDB
- Statut NVD
- Deferred
Description
A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| CVSS 3.1 | MEDIUM 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| CVSS 3.0 | MEDIUM 4.7 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| CVSS 2.0 | MEDIUM 5.8 | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
| CVSS 4.0 | LOW 2.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cna@vuldb.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L | NVD · cna@vuldb.com (Secondary) |
| CVSS 2.0 | MEDIUM 5.8 | AV:N/AC:L/Au:M/C:P/I:P/A:P | NVD · cna@vuldb.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-77489
- GCVE · GCVE-0-2026-90788
Produits affectés
| Produit | Versions |
|---|---|
| magicblack · MacCMS10 | affected 2026.1000.4055 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |