Priority HIGH 82
An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00792 · Published 2025-04-21 · Fixed in 5.4.4 CWE-434
Priority HIGH 82
Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0224 · Published 2023-12-30 · No fix listed CWE-89
Priority HIGH 82
SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01423 · Published 2023-04-04 · Fixed in 5.1 CWE-89
Priority HIGH 75
A vulnerability was found in Mingsoft MCMS up to 5.2.9.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0315 · Published 2022-12-09 · Fixed in 5.2.10 CWE-707
Priority HIGH 73
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01036 · Published 2023-01-24 · Fixed in 5.2.11 CWE-434
Priority HIGH 73
File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00924 · Published 2023-05-08 · No fix listed CWE-434
Priority HIGH 71
File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.17789 · Published 2024-02-05 · No fix listed CWE-434
Priority HIGH 70
MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00806 · Published 2024-09-03 · No fix listed CWE-434
Priority HIGH 66
An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01119 · Published 2024-01-16 · No fix listed CWE-94
Priority HIGH 66
A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00435 · Published 2022-12-21 · No fix listed CWE-707
Priority MEDIUM 63
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.23694 · Published 2022-01-20 · Fixed in 5.2.9 CWE-1336
Priority MEDIUM 60
A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00425 · Published 2022-12-08 · No fix listed CWE-707
Priority MEDIUM 56
A flaw has been found in mingSoft MCMS 6.1.1.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00411 · Published 2026-02-18 · No fix listed CWE-284
Priority MEDIUM 53
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.07734 · Published 2022-03-03 · No fix listed CWE-89
Priority MEDIUM 52
MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06981 · Published 2022-03-03 · No fix listed CWE-89
Priority MEDIUM 50
A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rende…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00636 · Published 2025-10-17 · Fixed in 6.0.2 CWE-89
Priority MEDIUM 50
Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05475 · Published 2022-04-05 · No fix listed CWE-89
Priority MEDIUM 48
File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03111 · Published 2022-01-26 · No fix listed CWE-434
Priority MEDIUM 48
An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03743 · Published 2022-02-18 · No fix listed CWE-434
Priority MEDIUM 47
An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02735 · Published 2022-05-27 · No fix listed CWE-434
Priority MEDIUM 47
MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02576 · Published 2022-01-20 · No fix listed CWE-434
Priority MEDIUM 47
MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.025 · Published 2022-01-20 · No fix listed CWE-798
Priority MEDIUM 46
MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01819 · Published 2022-01-20 · No fix listed CWE-434
Priority MEDIUM 46
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02218 · Published 2022-03-04 · Fixed in 5.2.6 CWE-306
Priority MEDIUM 45
MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0152 · Published 2022-07-01 · No fix listed CWE-434
Load more
THREATIST.IORead the docs