SQL Injection Vulnerability in Jackq XCMS Password Recovery Mail Function

CVE-2026-108799

What is CVE-2026-108799?

A SQL injection vulnerability has been identified in the Password Recovery Mail Endpoint of Jackq XCMS. Specifically, the flaw resides in the PublicController::sendFindPwdMail function located in Admin/Home/Controller/PublicController.class.php. By manipulating the email argument, an attacker can cause unfiltered input to be executed in database queries, leading to unauthorized access and potential data exposure. The possibility of remote exploitation raises serious security concerns, particularly as details of the exploit have been made publicly available, heightening the risk for affected users.

References