Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-124575 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CNA: [email protected]CVSS-B:3.7 LOWVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/siteserver/cms/blob/15144f30c6cc0e11d50985b6ab9236cfce8cacbd/src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs#L46	[email protected]	Source CodeVendor
https://github.com/siteserver/cms/commit/df3becb7ebb00a48435418a44fd08a459eb38ace	[email protected]	Source CodeVendor
https://github.com/siteserver/cms/pull/3905	[email protected]	Issue TrackingVendor
https://vuldb.com/cve/CVE-2026-124575	[email protected]	AdvisoryPermission Required
https://vuldb.com/submit/1038068	[email protected]	Issue TrackingPermission Required
https://vuldb.com/vuln/432921	[email protected]	BundlePermission Required
https://vuldb.com/vuln/432921/cti	[email protected]	Content Wall

see all 7 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-307	Improper Restriction of Excessive Authentication Attempts	[email protected]
CWE-799	Improper Control of Interaction Frequency	[email protected]

Affected Products

Product	Versions
SiteServer SSCMS	<= 7.1.3 (semver) <= 7.2.1 (semver) <= 7.4.0 (semver)
CPE cpe:2.3:a:siteserver:siteserver_cms:::::::: cpe:2.3:a:sscms:siteserver_cms:::::::: Remediation Patch: df3becb7ebb00a48435418a44fd08a459eb38acemoderate effort

Change History

1 change record found show changes