CVE-2022-26573

Published: Mar 25, 2022Modified: Jan 26, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters.

Affected (11)

Products: Maccms: Maccms

Maccms

1 product

Maccms

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Maccms Maccms	Version 10.0 2021.1000.1081
Maccms Maccms	Version 10.0 2022.1000.1099
Maccms Maccms	Version 10.0 2022.1000.3001
Maccms Maccms	Version 10.0 2022.1000.3002
Maccms Maccms	Version 10.0 2022.1000.3004
Maccms Maccms	Version 10.0 2022.1000.3005
Maccms Maccms	Version 10.0 2022.1000.3025
Maccms Maccms	Version 10.0 2022.1000.3026
Maccms Maccms	Version 10.0 2022.1000.3027
Maccms Maccms	Version 10.0 2022.1000.3028
Maccms Maccms	Version 10.0 2022.1000.3029

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/magicblack/maccms10/commit/026a2893d7de4ba4987b670b292ba569f3b8d296#diff-498970d2c74a54ff851bf844ce006053b7bb7042b19711a81966554f62aff753L41-R47

Source: cve@mitre.org

https://github.com/magicblack/maccms10/issues/840

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://github.com/magicblack/maccms10/issues/840

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.