CVE-2026-108799: jackq XCMS Password Recovery Mail Endpoint PublicController.class.php sendFindPwdMail sql injection
A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is remotely exploitable and requires no privileges or user interaction. The vulnerable input is the email argument handled by the password recovery mail endpoint.
Which deployments should be treated as affected?
jackq XCMS versions up to commit 3fab5342cc509945a7ce1b8ec39d19f701b89261 are identified as affected. Systems exposing the password recovery mail functionality should be prioritized because the vulnerable function is part of that endpoint.
Is there evidence that exploitation is practical?
Yes. A public exploit disclosure exists, and the exploit may be used by attackers. The available assessment rates exploit maturity as proof-of-concept.