CVE-2026-124575

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.

• CWE-307
• CWE-799

• https://github.com/siteserver/cms/blob/15144f30c6cc0e11d50985b6ab9236cfce8cacbd/src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs#L46
• https://github.com/siteserver/cms/commit/df3becb7ebb00a48435418a44fd08a459eb38ace
• https://github.com/siteserver/cms/pull/3905
• https://vuldb.com/cve/CVE-2026-124575
• https://vuldb.com/submit/1038068
• https://vuldb.com/vuln/432921
• https://vuldb.com/vuln/432921/cti

Published

Nov 9, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12457Inappropriate implementation in Extensions in Google Chrome …4.2
• CVE-2026-124570A vulnerability was detected in SourceCodester Online Leave …2.4
• CVE-2026-124571A flaw has been found in SourceCodester Simple CRUD using PH…6.3
• CVE-2026-124572A vulnerability has been found in DataLinkDC dinky up to 1.2…5.4
• CVE-2026-124573A vulnerability was found in logseq 2.0.1/2.0.2. This affect…7.3
• CVE-2026-124574A vulnerability was determined in chenyme grok2api up to 3.1…6.3
• CVE-2026-124576A security flaw has been discovered in BeikeShop up to 2.0.0…7.3
• CVE-2026-124577A weakness has been identified in Intelbras SG 2404 PoE L2+ …9.8
• CVE-2026-124578A security vulnerability has been detected in Pantum BP5100D…5.3
• CVE-2026-124579A vulnerability was determined in aaPanel BillionMail up to …7.4
• CVE-2026-12458Inappropriate implementation in Passwords in Google Chrome p…3.1
• CVE-2026-124580A vulnerability was found in Chengdu Feiyuxing Technology VW…10