Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11 results
Aug 21, 2025MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component.CVE-2025-51818 · Other software · Chshcms · reported by MITREMedium 5.4
MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 6, 2025MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.CVE-2025-50234 · Other software · Chshcms · reported by MITREMedium 6.5
MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sys_auth($pic, 1) function, which utilizes a hard-coded key Mc_Encryption_Key (bD2voYwPpNuJ7B8), defined in the db.php file. The decrypted URL is passed to the geturl() method, which uses cURL to make a request to the URL without proper security checks. An attacker can craft a malicious encrypted pic parameter, which, when decrypted, points to internal addresses or local file paths (such as http://127.0.0.1 or file://). By using the file:// protocol, the attacker can access arbitrary files on the local file system (e.g., file:///etc/passwd, file:///C:/Windows/System32/drivers/etc/hosts), allowing them to read sensitive configuration files, log files, and more, leading to information leakage or system exposure. The danger of this SSRF vulnerability includes accessing internal services and local file systems through protocols like http://, ftp://, and file://, which can result in sensitive data leakage, remote code execution, privilege escalation, or full system compromise, severely affecting t
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crCVE-2025-51651 · Other software · Chshcms · reported by MITREMedium 5.5
An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025A vulnerability was found in chshcms mccms 2.7.CVE-2025-5328 · Other software · chshcms · reported by VulDBMedium 5.3
A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restore_del of the file /sys/apps/controllers/admin/Backups.php. The manipulation of the argument dirs leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2025A vulnerability was found in chshcms mccms 2.7.CVE-2025-5327 · Other software · chshcms · reported by VulDBMedium 5.3
A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2023A vulnerability, which was classified as critical, was found in mccms 2.6.CVE-2023-5029 · Other software · Chshcms · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulation with the input '"1 leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239871.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability classified as critical has been found in mccms up to 2.6.5.CVE-2023-3236 · Other software · Chshcms · reported by VulDBMedium 6.3
A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function pic_save of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231507.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2023A vulnerability was found in mccms up to 2.6.5.CVE-2023-3235 · Other software · Chshcms · reported by VulDBMedium 6.3
A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function pic_api of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231506 is the identifier assigned to this vulnerability.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache ConfiguraCVE-2023-26782 · Other software · Chshcms · reported by MITREMedium 6.5
An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.CVE-2023-26781 · Other software · Chshcms · reported by MITRECritical 9.8
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).CVE-2023-29815 · Other software · Chshcms · reported by MITREHigh 8.8
mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).
- Product
- Mccms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.