CVE-2025-10397: Magicblack MacCMS API server-side request forgery

Published Sep 14, 2025

Updated

A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulation of the argument cjurl leads to server-side request forgery. The attack can be initiated remotely. The exploit is publicly available and might be used.

Affected Software

2 affected components

Magicblack MacCMS

maccms Maccms=10.0-2025.1000.4050

Event History

Sep 14, 2025

CVE Published

via MITRE·11:02 AM

Data Sourced

via MITRE·11:02 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:15 AM

DescriptionSeverityWeaknessAffected Software

Feb 13, 57740

Event

via NVD·12:29 AM

Frequently Asked Questions

What is the severity of CVE-2025-10397?

CVE-2025-10397 is considered a high severity vulnerability due to its potential for server-side request forgery.

How do I fix CVE-2025-10397?

To mitigate CVE-2025-10397, it is recommended to apply the latest security patches provided by Magicblack for the MacCMS software.

What type of attack is enabled by CVE-2025-10397?

CVE-2025-10397 enables a server-side request forgery (SSRF) attack which can be initiated remotely.

Which component is affected by CVE-2025-10397?

CVE-2025-10397 affects the API Handler component of the Magicblack MacCMS software.

Is the exploit for CVE-2025-10397 publicly available?

Yes, the exploit for CVE-2025-10397 is publicly available, making it crucial for users to address this vulnerability quickly.