jackq CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM jackq CVE published 2026-10-12

CVE-2026-108799

A SQL injection vulnerability was found in jackq XCMS up to version 3fab5342cc509945a7ce1b8ec39d19f701b89261, specifically in the PublicController::sendFindPwdMail function of the Admin/Home/Controller/PublicController.class.php file. This vulnerability allows remote attackers to inject malicious SQL code through the email argument in the password recovery mail endpoint.