masacms has 4 CVEs on record. The busiest recent month was December 2025 with 4. The median CVSS is 8.5 (high), with 1 rated critical.

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 8.5
Publish → KEV: —
Last 90 days: 0 prev 0

Weakness classes

Products

masacms 4

Follow masacms:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

masacms vulnerabilities

CVEs affecting masacms, newest first. Open any entry for full detail, references, and exploit status.

4 CVEsRSS

CVE-2025-66492High· 8.2

10mo ago

Masa CMS is an open source Enterprise Content Management platform

Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query …

▾ Twilightmasacms · masacmsEPSS 0.25%via NVD

CVE-2024-32643High· 7.5

11mo ago

Masa CMS is an open source Enterprise Content Management platform

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This …

▾ Twilightmasacms · masacmsEPSS 0.36%via NVD

CVE-2024-32642High· 8.8

11mo ago

Masa CMS is an open source Enterprise Content Management platform

Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2…

▾ Twilightmasacms · masacmsEPSS 0.20%via NVD

CVE-2024-32641Critical· 9.8

11mo ago

Masa CMS is an open source Enterprise Content Management platform

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input v…

▾ Midnightmasacms · masacmsEPSS 12%via NVD