High severity7.3NVD Advisory· Published Oct 12, 2026

CVE-2026-108799

Description

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Jackq/Xcmsllm-fuzzy
Range: <3fab5342cc509945a7ce1b8ec39d19f701b89261

Patches

Vulnerability mechanics

References

github.com/wawyw/cve_report/blob/main/xcms_2.mdnvd
vuldb.com/cve/CVE-2026-108799nvd
vuldb.com/submit/961602nvd
vuldb.com/vuln/416576nvd
vuldb.com/vuln/416576/ctinvd

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000