Medium 5.6Published Jul 12, 2026

CVE-2026-15516MacCMS Pro Installation Index.php step5 authorization

Updated under an hour ago (Oct 27, 2026, 7:30 AM ET)

Does this affect you?

It affects n/a MacCMS Pro. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for n/a MacCMS Pro

Exploited in the last 30 days

A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the component Installation Module. The manipulation results in authorization bypass. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. Upgrading to version 2022.1000.3025 is recommended to address this issue. Upgrading the affected component is recommended.

CVSS: 5.6 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Weakness (CWE): CWE-639, CWE-285
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Jul 13, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

n/a MacCMS Pro maccms_pro:maccms_pro	2022.1000.3005; 2022.1000.3025 not affected	CNA record

References

References

https://vuldb.com/vuln/377845	vdb-entry, technical-description
https://vuldb.com/vuln/377845/cti	signature, permissions-required
https://vuldb.com/cve/CVE-2026-15516	third-party-advisory
https://vuldb.com/submit/848741	third-party-advisory
https://github.com/trustbigcat/CVE/	exploit
https://github.com/magicblack/maccms10/releases?page=3#release-v2022.1000.3025	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.