Masacms vulnerabilities

Products

• Masacms 15

Newest

• masacms Masa CMS open redirect via improper handling of scheme-relative URLs CVE-2026-40332 5.3 MediumMay 6, 2026
• masacms Masa CMS CSRF in site bundle creation allows unauthorized site data export CVE-2026-40326 7.1 HighMay 6, 2026
• masacms Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content CVE-2026-40325 8.7 HighMay 6, 2026
• masacms Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content CVE-2026-40309 7.2 HighMay 6, 2026
• masacms Masa CMS CSRF in user address management allows unauthorized address changes CVE-2026-40174 7.1 HighMay 6, 2026
• masacms Masa CMS unauthenticated SQL injection via altTable parameter in JSON API CVE-2026-40331 9.3 CriticalMay 5, 2026
• masacms Masa CMS SQL injection via sortDirection parameter in beanFeed CVE-2026-40330 9.3 CriticalMay 5, 2026
• masacms SQL Injection vulnerability via sortBy in beanFeed CVE-2026-40329 9.3 CriticalMay 5, 2026
• masacms Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter CVE-2025-66492 8.2 HighDecember 12, 2025
• masacms Masa CMS vulnerable to authentication bypass with /tag/ CVE-2024-32643 7.5 HighDecember 3, 2025
• masacms Host header poisoning allows account takeover via password reset email CVE-2024-32642 8.8 HighDecember 3, 2025
• masacms Masa CMS Vulnerable to Pre-Auth RCE via JSON API CVE-2024-32641 EPSS 13.1% 9.8 CriticalDecember 3, 2025
• masacms MasaCMS SQL Injection vulnerability CVE-2024-32640 Public exploit EPSS 78.4% 9.8 CriticalAugust 11, 2025
• masacms A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers... CVE-2022-47002 9.8 CriticalFebruary 1, 2023
• masacms MasaCMS 7.2.1 is affected by a path traversal vulnerability in /index.cfm/_api/asset/image/. CVE-2021-42183 Public exploit 7.5 HighMay 5, 2022