MasaCMS vulnerabilities

CVEs per yearBy the year they were published

1. 20255
2. 20268

Newest CVEs

• CVE-2026-40332

  Masa CMS open redirect via improper handling of scheme-relative URLs

  MasaCMS · MasaCMS

  Medium5.3
• CVE-2026-40326

  Masa CMS CSRF in site bundle creation allows unauthorized site data export

  MasaCMS · MasaCMS

  High7.1
• CVE-2026-40325

  Masa CMS CSRF in content restoration allows unauthorized restoration of deleted content

  MasaCMS · MasaCMS

  High8.7
• CVE-2026-40309

  Masa CMS CSRF in trash management allows unauthorized permanent deletion of deleted content

  MasaCMS · MasaCMS

  High7.2
• CVE-2026-40174

  Masa CMS CSRF in user address management allows unauthorized address changes

  MasaCMS · MasaCMS

  High7.1
• CVE-2026-40331

  Masa CMS unauthenticated SQL injection via altTable parameter in JSON API

  MasaCMS · MasaCMS

  Critical9.3
• CVE-2026-40330

  Masa CMS SQL injection via sortDirection parameter in beanFeed

  MasaCMS · MasaCMS

  Critical9.3
• CVE-2026-40329

  SQL Injection vulnerability via sortBy in beanFeed

  MasaCMS · MasaCMS

  Critical9.3
• CVE-2025-66492

  Masa CMS vulnerable to Cross-Site Scripting (XSS) through URL Parameter

  MasaCMS · MasaCMS

  High8.2
• CVE-2024-32643

  Masa CMS vulnerable to authentication bypass with /tag/

  MasaCMS · MasaCMS

  High7.5