Advisories · Technology
MasaCMS.
Every CVE that names MasaCMS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Masa CMS open redirect via improper handling of scheme-relative URLs
- MasaCMS
- Open redirect
- CVSS 7.1 High
Masa CMS CSRF in site bundle creation allows unauthorized site data export
- MasaCMS
- Cross-site request forgery (CSRF)
- CVSS 8.7 High
Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content
- MasaCMS
- Cross-site request forgery (CSRF)
- CVSS 7.2 High
Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content
- MasaCMS
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
Masa CMS CSRF in user address management allows unauthorized address changes
- MasaCMS
- Cross-site request forgery (CSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
Masa CMS unauthenticated SQL injection via altTable parameter in JSON API
- MasaCMS
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Masa CMS SQL injection via sortDirection parameter in beanFeed
- MasaCMS
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
SQL Injection vulnerability via sortBy in beanFeed
- MasaCMS
- SQL injection
- CVSS 8.2 High
Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter
- MasaCMS
- Cross-site scripting (XSS)
- CVSS 7.5 High
Masa CMS vulnerable to authentication bypass with /tag/
- MasaCMS
- Broken access control
- CVSS 8.8 High
Host header poisoning allows account takeover via password reset email
- MasaCMS
- CWE-346
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Masa CMS Vulnerable to Pre-Auth RCE via JSON API
- MasaCMS
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
MasaCMS SQL Injection vulnerability
- MasaCMS
- SQL injection