CVE-2026-108799

jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection

State: Published
Severity: 6.9 Medium
Published: Oct 12, 2026
Updated: Oct 13, 2026
Reserved: Oct 11, 2026

Description

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C	VulDB
3.0	7.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C	VulDB

Weaknesses

CWE-89 SQL Injection
CWE-74 Injection

Affected Products

Product	Versions
XCMSjackq	3fab5342cc509945a7ce1b8ec39d19f701b89261Affected

References

VDB-416576 | jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injectionvdb-entrytechnical-description
VDB-416576 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-108799 | CVE Analysis and Reportthird-party-advisory
Submit #961602 | jackq XCMS 3fab5342cc509945a7ce1b8ec39d19f701b89261 SQL Injectionthird-party-advisory
https://github.com/wawyw/cve_report/blob/main/xcms_2.mdexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.