Vulnerability · Published Oct 12, 2026 · Assigned by VulDB

CVE-2026-108799jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection

High 7.3

In plain English

A high-severity SQL injection in XCMS from jackq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 83.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
jackq	XCMS	3fab5342cc509945a7ce1b8ec39d19f701b89261

Weakness: CWE-89, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-416576 | jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection vdb-entry, technical-description
VDB-416576 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-108799 | CVE Analysis and Report third-party-advisory
Submit #961602 | jackq XCMS 3fab5342cc509945a7ce1b8ec39d19f701b89261 SQL Injection third-party-advisory
https://github.com/wawyw/cve_report/blob/main/xcms_2.md exploit