4 matches found
EUVD-2026-102500
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpassreset to overwrite the member's password...
CVE-2026-111356
MacCMS versions v10 through 2026.1000.4056 are vulnerable to an Account Takeover due to a lack of rate limiting on the six-digit password recovery code. An unauthenticated attacker who knows a victim's email or phone number can request a recovery code and perform a brute-force attack on the findp...
CVE-2026-111356 MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpassreset to overwrite the member's password...
CVE-2026-111356 MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpassreset to overwrite the member's password...