CVE-2026-108799

jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Affected

jackq · XCMS

CVSS v4.0 VULDB

5.5 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULDB

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 VULDB

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.39% chance of exploitation in the next 30 days, 32nd percentile

Published

2026-10-12

Updated

2026-10-13

Proof-of-concept exploits (1)

• wawyw/cve_report/blob/main/xcms_2.md

References

• CVE Record
• NVD entry

Related

• CVE-2026-103540
• CVE-2026-103541
• CVE-2026-103542
• CVE-2026-108790
• CVE-2026-108791