PT-2026-123323

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check msg never compares msg to. Attackers can request a recovery code to their own mailbox via user/findpass msg, then submit it to...