CVE-2026-124575 PUBLISHED

SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication

Assigner: VulDB
Reserved: 08.11.2026 Published: 09.11.2026 Updated: 09.11.2026

A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.0. This issue affects the function LoginController.Submit of the file src/SSCMS.Web/Controllers/Admin/LoginController.Submit.cs of the component Admin-Login CAPTCHA. Such manipulation of the argument isForceLogoutAndLogin leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The name of the patch is df3becb7ebb00a48435418a44fd08a459eb38ace. Applying a patch is advised to resolve this issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
CVSS Score: 6.3

Product Status

Vendor SiteServer
Product SSCMS
Versions
  • Version 7.0 is affected
  • Version 7.1 is affected
  • Version 7.1.0 is affected
  • Version 7.1.1 is affected
  • Version 7.1.2 is affected
  • Version 7.1.3 is affected
  • Version 7.2 is affected
  • Version 7.2.0 is affected
  • Version 7.2.1 is affected
  • Version 7.3 is affected
  • Version 7.4.0 is affected

Credits

  • The_S7s (VulDB User) reporter

References

Problem Types

  • Improper Restriction of Excessive Authentication Attempts CWE
  • Improper Control of Interaction Frequency CWE