MMasaCMS

Products

Exploited and recent CVEs

• CVE-2026-40332 Medium 5.3 Masa CMS open redirect via improper handling of scheme-relative URLs 0.3%
• CVE-2026-40326 High 7.1 Masa CMS CSRF in site bundle creation allows unauthorized site data export 0.2%
• CVE-2026-40325 High 8.7 Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content 0.2%
• CVE-2026-40309 High 7.2 Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content 0.2%
• CVE-2026-40174 High 7.1 Masa CMS CSRF in user address management allows unauthorized address changes 0.2%
• CVE-2026-40331 Critical 9.3 Masa CMS unauthenticated SQL injection via altTable parameter in JSON API 0.3%
• CVE-2026-40330 Critical 9.3 Masa CMS SQL injection via sortDirection parameter in beanFeed 0.4%
• CVE-2026-40329 Critical 9.3 SQL Injection vulnerability via sortBy in beanFeed 0.3%
• CVE-2025-66492 High 8.2 Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter 0.2%
• CVE-2024-32643 High 7.5 Masa CMS vulnerable to authentication bypass with /tag/ 0.4%
• CVE-2024-32642 High 8.8 Host header poisoning allows account takeover via password reset email 0.2%
• CVE-2024-32641 Critical 9.8 Masa CMS Vulnerable to Pre-Auth RCE via JSON API 13.1%
• CVE-2024-32640 Critical 9.8 MasaCMS SQL Injection vulnerability 78.4%