Priority HIGH 82
SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0098 · Published 2023-04-28 · No fix listed CWE-89
Priority HIGH 73
mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00295 · Published 2023-04-28 · No fix listed CWE-352
Priority MEDIUM 62
MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00294 · Published 2025-08-06 · No fix listed CWE-918
Priority MEDIUM 62
An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00872 · Published 2023-04-28 · No fix listed CWE-94
Priority MEDIUM 60
MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00258 · Published 2025-08-21 · No fix listed CWE-552
Priority MEDIUM 58
An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.
CVSS 3.1MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.00227 · Published 2025-07-14 · No fix listed CWE-598
Priority MEDIUM 57
A vulnerability was found in chshcms mccms 2.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.01309 · Published 2025-05-29 · No fix listed CWE-22
Priority MEDIUM 57
A vulnerability was found in chshcms mccms 2.7.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00564 · Published 2025-05-29 · No fix listed CWE-918
Priority MEDIUM 56
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.11954 · Published 2022-05-26 · No fix listed CWE-89
Priority MEDIUM 48
CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugins\sys\Install.php.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03233 · Published 2018-09-17 · No fix listed CWE-94
Priority MEDIUM 47
A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02874 · Published 2021-08-30 · No fix listed
Priority MEDIUM 45
cscms v4.1 allows for SQL injection via the "js_del" function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01253 · Published 2022-01-11 · No fix listed CWE-89
Priority MEDIUM 45
CScms 4.1 allows arbitrary file upload by (for example) adding the php extension to the default filetype list (gif, jpg, png), and then providing a .php pathname within fileurl JSON data.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01491 · Published 2018-09-08 · No fix listed CWE-434
Priority MEDIUM 44
cscms v4.1 allows for SQL injection via the "page_del" function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01133 · Published 2022-01-11 · No fix listed CWE-89
Priority MEDIUM 44
An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0097 · Published 2021-12-27 · No fix listed CWE-307
Priority MEDIUM 40
CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0097 · Published 2022-05-26 · No fix listed CWE-89
Priority MEDIUM 40
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0097 · Published 2022-05-26 · No fix listed CWE-89
Priority MEDIUM 40
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via /admin.php/pic/admin/pic/hy.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0097 · Published 2022-05-26 · No fix listed CWE-89
Priority MEDIUM 40
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/pl_save.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0097 · Published 2022-05-26 · No fix listed CWE-89
Priority MEDIUM 40
Cscms 4.1 is vulnerable to SQL Injection.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00859 · Published 2022-05-04 · No fix listed CWE-89
Priority LOW 39
A vulnerability, which was classified as critical, was found in mccms 2.6.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00641 · Published 2023-09-17 · No fix listed CWE-89
Priority LOW 39
A vulnerability classified as critical has been found in mccms up to 2.6.5.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00701 · Published 2023-06-14 · No fix listed CWE-918
Priority LOW 39
A vulnerability was found in mccms up to 2.6.5.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00701 · Published 2023-06-14 · No fix listed CWE-918
Priority LOW 39
\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftp_save.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00518 · Published 2018-09-08 · No fix listed CWE-352
Priority LOW 39
Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web edit…
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00494 · Published 2018-09-04 · No fix listed CWE-352
Load more
THREATIST.IORead the docs