jackq XCMS

• CVE-2026-108799 High 7.3 jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection 0.3%
• CVE-2025-15110 Medium 4.7 jackq XCMS Backend ProductImageController.class.php upload unrestricted upload 0.4%
• CVE-2025-15109 High 7.3 jackq XCMS upload.php unrestricted upload 0.3%