MacCMS10 v2026.1000.4055 admin SSRF #1377

In the maccms v2026.1000.4055 backend, an SSRF vulnerability exists in the API URL field when navigating to http://localhost/maccms10-2026.1000.4055/admin1.php/admin/collect and selecting the "Add" option. Although filters are in place to block localhost and 127.0.0.1, these can be bypassed using 127.0.0.2 or [::1]

additionally, this vulnerability can be exploited to probe for open services on other machines.