CVE-2026-126993

MEDIUM 5.3

SiteServer SSCMS captcha inadequate encryption

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-326 CWE-310
Vendor	siteserver
Product	sscms
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for siteserver sscms

Be the first to know when new medium vulnerabilities affecting siteserver sscms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

SiteServer / SSCMS

7.2.0 7.2.1 7.2.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/436288 vuldb.com: https://vuldb.com/vuln/436288/cti vuldb.com: https://vuldb.com/cve/CVE-2026-126993 vuldb.com: https://vuldb.com/submit/1040543

Credits

🔍 ssss-s (VulDB User) VulDB CNA Team