CVE-2026-116215

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is...

EUVD-2026-109807

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is...

CVE-2026-116215

MacCMS versions v10 through 2026.1000.4056 are vulnerable to a race condition in the Card::useData() function. This flaw allows authenticated members to redeem a single recharge card multiple times by sending concurrent flag=card requests via the user/buy endpoint. Because the system performs a n...