CVE-2025-10395

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in Magicblack MacCMS 2025.1000.4050. Affected by this vulnerability is the function col_url of the component Scheduled Task Handler. Performing manipulation of the argument cjurl results in server-side request forgery. It is possible to initiate the attack remotely.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Magicblack	MacCMS	2025.1000.4050

References

https://github.com/August829/Yu/blob/main/58ead8e7e08bfb017.mdBroken Link
https://vuldb.com/?ctiid.323830Permissions Required, VDB Entry
https://vuldb.com/?id.323830Third Party Advisory, VDB Entry
https://vuldb.com/?submit.645798Third Party Advisory, VDB Entry

Timeline

Published: Sep 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-103969.8A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. Affected by this issue is some unknown functionality CVE-2025-103977.2A vulnerability was identified in Magicblack MacCMS 2025.1000.4050. This affects an unknown part of the component API Handler. The manipulat CVE-2025-103988.8A security flaw has been discovered in fcba_zzm ics-park Smart Park Management System 2.0. This vulnerability affects unknown code of the fi CVE-2025-103996.3A weakness has been identified in Korzh EasyQuery up to 7.4.0. This issue affects some unknown processing of the file /api/easyquery/models/CVE-2025-10408.8AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE).CVE-2025-104008.8A security vulnerability has been detected in SourceCodester Food Ordering Management System 1.0. Impacted is an unknown function of the fil CVE-2025-104018.8A vulnerability was detected in D-Link DIR-823x up to 250416. The affected element is an unknown function of the file /goform/diag_ping. Per CVE-2025-104029.8A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/rea CVE-2025-104039.8A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/view-CVE-2025-104049.8A vulnerability was found in itsourcecode Baptism Information Management System 1.0. This impacts an unknown function of the file /rptbaptis CVE-2025-104059.8A vulnerability was determined in itsourcecode Baptism Information Management System 1.0. Affected is an unknown function of the file /listb CVE-2025-104065.5The BlindMatrix e-Commerce WordPress plugin before 3.1 does not validate some shortcode attributes before using them to generate paths passe