CVE-2024-32642High· 8.8▾ TwilightMasa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 26.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.
masacms < 7.2.8masacms >= 7.3, < 7.3.13masacms >= 7.4.0, < 7.4.6Upgrade past the affected range:
masacms 7.4.6Connected by shared product, vendor, weakness, or advisory.
CVE-2025-66492High· 8.2Masa CMS is an open source Enterprise Content Management platform
CVE-2024-32643High· 7.5Masa CMS is an open source Enterprise Content Management platform
CVE-2024-32641Critical· 9.8Masa CMS is an open source Enterprise Content Management platform
CVE-2026-119285Medium· 5.9Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
CVE-2026-118657Medium· 5.9Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
CVE-2026-118651Medium· 5.3Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default