CVE-2017-17733
CriticalSummary
Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
Risk Assessment
Exploitation of this vulnerability may lead to an attacker gaining control over the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update to the latest version of Maccms to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in Maccms 8.x
See all- CVE-2026-111356High
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.
- CVE-2026-75465High
Incorrect Access Control vulnerability in the /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users.
Original NVD description (English source)
Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS