Server-Side Request Forgery Vulnerability in Maccms10 by Magicblack
CVE-2025-28089

9.1CRITICAL

Key Information:

Vendor

Magicblack

Status
Maccms10
Vendor
CVE Published:
28 March 2025

What is CVE-2025-28089?

Maccms10 version 2025.1000.4047 contains a vulnerability that allows Server-Side Request Forgery (SSRF) through its Scheduled Task function. This flaw can be exploited by remote attackers to send unauthorized requests from the server, potentially accessing sensitive internal resources and thus leading to further exploitation or information leakage.

References

https://github.com/magicblack/maccms10/releases/tag/v2025...
https://www.yuque.com/morysummer/vx41bz/wzer7qxh0vwrf6zq

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.