magicblack/maccms10

GitHub

github.com

Releases43

Frequency1 month 2 weeks

Last Release 14 days ago

Stars2.8K

苹果CMS v10 · MacCMS v10 — 开源内容管理系统：视频 / 分集剧情 / 文章 / 漫画 / 图片 / 网址导航. Open-source PHP CMS for video, articles, manga, images & site navigation.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-28089 ↗	Mar 28, 2025Friday, 28 March 2025, 22:15	9.1 CRITICAL	—
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
CVE-2024-46654 ↗	Sep 20, 2024Friday, 20 September 2024, 19:15	4.8 MEDIUM	—
A stored cross-site scripting (XSS) vulnerability in the Add Scheduled Task module of Maccms10 v2024.1000.4040 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-32391 ↗	Apr 19, 2024Friday, 19 April 2024, 21:15	7.3 HIGH	—
Cross Site Scripting vulnerability in MacCMS v.10 v.2024.1000.3000 allows a remote attacker to execute arbitrary code via a crafted payload.
CVE-2022-44870 ↗	Jan 6, 2023Friday, 6 January 2023, 03:15	6.1 MEDIUM	—
A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the AD Management module.
CVE-2022-35148 ↗	Aug 17, 2022Wednesday, 17 August 2022, 21:15	6.5 MEDIUM	—
maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html.
CVE-2022-27884 ↗	Mar 25, 2022Friday, 25 March 2022, 19:15	6.1 MEDIUM	4.3 MEDIUM
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index.html via the wd parameter.
CVE-2022-27887 ↗	Mar 25, 2022Friday, 25 March 2022, 19:15	6.1 MEDIUM	4.3 MEDIUM
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.html via the repeat parameter.
CVE-2022-27886 ↗	Mar 25, 2022Friday, 25 March 2022, 19:15	6.1 MEDIUM	4.3 MEDIUM
Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index.html via the wd parameter.
CVE-2022-27885 ↗	Mar 25, 2022Friday, 25 March 2022, 19:15	6.1 MEDIUM	4.3 MEDIUM
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters.
CVE-2022-26573 ↗	Mar 25, 2022Friday, 25 March 2022, 19:15	6.1 MEDIUM	4.3 MEDIUM
Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters.
CVE-2021-45787 ↗	Mar 16, 2022Wednesday, 16 March 2022, 13:15	5.4 MEDIUM	3.5 LOW
There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks.
CVE-2021-45786 ↗	Mar 16, 2022Wednesday, 16 March 2022, 13:15	9.8 CRITICAL	7.5 HIGH
In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges.
CVE-2020-21387 ↗	Oct 4, 2021Monday, 4 October 2021, 20:15	6.1 MEDIUM	4.3 MEDIUM
A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload.
CVE-2020-21386 ↗	Oct 4, 2021Monday, 4 October 2021, 20:15	8.8 HIGH	6.8 MEDIUM
A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges.
CVE-2020-20514 ↗	Sep 24, 2021Friday, 24 September 2021, 22:15	8.1 HIGH	4.9 MEDIUM
A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.
CVE-2020-21363 ↗	Aug 11, 2021Wednesday, 11 August 2021, 21:15	6.5 MEDIUM	5.5 MEDIUM
An arbitrary file deletion vulnerability exists within Maccms10.
CVE-2020-21362 ↗	Aug 11, 2021Wednesday, 11 August 2021, 21:15	5.4 MEDIUM	3.5 LOW
A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter.
CVE-2020-21359 ↗	Aug 11, 2021Wednesday, 11 August 2021, 21:15	9.8 CRITICAL	7.5 HIGH
An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name.