{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xcms--3fab5342cc509945a7ce1b8ec39d19f701b89261/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:jackq:xcms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-108799"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["XCMS (\u003c= 3fab5342cc509945a7ce1b8ec39d19f701b89261)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","sqli","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["jackq"],"content_html":"\u003cp\u003eA critical SQL injection vulnerability has been identified in jackq XCMS, affecting versions up to the commit hash 3fab5342cc509945a7ce1b8ec39d19f701b89261. The flaw resides within the PublicController::sendFindPwdMail function located in Admin/Home/Controller/PublicController.class.php. This function incorrectly handles the email argument during the password recovery process, enabling remote attackers to inject malicious SQL commands. Because this vulnerability is exposed through the password recovery endpoint, it does not require prior authentication, significantly increasing the risk of unauthorized database access, data exfiltration, or modification. An exploit has been publicly disclosed, making it highly likely that malicious actors will attempt to weaponize this endpoint in the near future.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthenticated attackers to perform arbitrary operations on the application database. This can lead to full database compromise, unauthorized administrative access, or the theft of sensitive user information. Given that this component is a core part of the account management system, defenders should prioritize patching or restricting access to the password recovery endpoint until a fix is deployed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit web logs for HTTP requests directed to the password recovery endpoint containing SQL injection patterns such as OR 1=1, UNION SELECT, or stacked queries.\u003c/li\u003e\n\u003cli\u003eImplement input validation and parameterized queries for the email parameter in the Admin/Home/Controller/PublicController.class.php component.\u003c/li\u003e\n\u003cli\u003eMonitor web application firewall (WAF) logs for blocks related to SQL injection signatures targeting the XCMS password recovery controller.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T06:07:28Z","date_published":"2026-10-12T06:07:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-xcms-sqli/","summary":"A SQL injection vulnerability in the jackq XCMS password recovery function allows remote attackers to execute arbitrary database queries via the email parameter.","title":"SQL Injection in jackq XCMS Password Recovery","url":"https://feed.craftedsignal.io/briefs/2026-10-xcms-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - XCMS (\u003c= 3fab5342cc509945a7ce1b8ec39d19f701b89261)","version":"https://jsonfeed.org/version/1.1"}