CVE-2026-108799

HIGH 7.3

jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CWE	CWE-89 CWE-74
Vendor	jackq
Product	xcms
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for jackq xcms

Be the first to know when new high vulnerabilities affecting jackq xcms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

jackq / XCMS

3fab5342cc509945a7ce1b8ec39d19f701b89261

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/416576 vuldb.com: https://vuldb.com/vuln/416576/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108799 vuldb.com: https://vuldb.com/submit/961602 github.com: https://github.com/wawyw/cve_report/blob/main/xcms_2.md

Credits

🔍 wenyouwen (VulDB User)