Inadequate Encryption Flaw in SiteServer SSCMS by SiteServer
CVE-2026-126993

6.9MEDIUM

Key Information:

Vendor

Siteserver

Status
Sscms
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126993?

A vulnerability has been identified in SiteServer SSCMS versions up to 7.2.2 concerning insufficient encryption strength in the file /api/v1/captcha. This weakness allows attackers to manipulate the argument Value, potentially leading to remote exploitation. The flaw poses significant risks to data integrity and confidentiality, with exploit code made publicly available, raising concerns over the security of affected installations. Despite early disclosure attempts, the vendor has not provided a response regarding mitigation measures.

Affected Version(s)

SSCMS 7.2.0

SSCMS 7.2.1

SSCMS 7.2.2

References

https://vuldb.com/vuln/436288
vdb-entrytechnical-description
https://vuldb.com/vuln/436288/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-126993
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ssss-s (VulDB User)
VulDB CNA Team
.