CVE-2026-126993: SiteServer SSCMS captcha inadequate encryption
A security flaw has been discovered in SiteServer SSCMS up to 7.2.2. Impacted is an unknown function of the file /api/v1/captcha. Performing a manipulation of the argument Value results in inadequate encryption strength. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which deployments are affected?
SiteServer SSCMS versions up to and including 7.2.2 are affected. The issue is associated with the /api/v1/captcha endpoint.
What does an attacker need to exploit this issue?
The attack can be performed remotely and requires manipulation of the Value argument. The supplied severity vector indicates no privileges or user interaction are required.
Is public exploit code available?
Yes. An exploit has been publicly released and may be used in attacks.
Is a vendor fix or response available?
The available information states that the vendor was contacted early but did not respond. It does not provide a fixed version or workaround.