CVE-2026-108799

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

• CWE-74
• CWE-89

• https://github.com/wawyw/cve_report/blob/main/xcms_2.md
• https://vuldb.com/cve/CVE-2026-108799
• https://vuldb.com/submit/961602
• https://vuldb.com/vuln/416576
• https://vuldb.com/vuln/416576/cti

Published

Oct 12, 2026

Last Modified

Oct 12, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108791A weakness has been identified in westboy CicadasCMS up to 2…4.3
• CVE-2026-108794A security vulnerability has been detected in ZKTeco BioTime…6.3
• CVE-2026-108795A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 2…4.3
• CVE-2026-108796A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130…4.3
• CVE-2026-108797A vulnerability has been found in ZKTeco BioTime 9.5.6 Build…4.3
• CVE-2026-108798A vulnerability was found in ZKTeco BioTime 9.5.6 Build 2026…7.3
• CVE-2026-1088The Login Page Editor plugin for WordPress is vulnerable to …4.3
• CVE-2026-10880OSNexus QuantaStor SDS Manager is vulnerable to SQL injectio…9.8
• CVE-2026-108800A vulnerability was identified in yangzongzhuan RuoYi 4.8.3.…4.3
• CVE-2026-108801A security flaw has been discovered in prasathmani TinyFileM…6.3
• CVE-2026-108802A weakness has been identified in y_project RuoYi up to 4.8.…3.5
• CVE-2026-108803A security vulnerability has been detected in y_project RuoY…6.3