Mrcms

Records22All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Mrcms records in CISA KEV

No Mrcms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mrcms 22 records HIGH

Records

22 records

TI-2026-23922 CVE-2026-31272 · GHSA-84xj-452r-299m

MRCMS 3.1.2 contains an access control vulnerability.

HIGH 82

MRCMS 3.1.2 contains an access control vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00599 Published 2026-04-07 No fix listed CWE-284

TI-2024-32292 CVE-2024-48177 · GHSA-w688-vpw2-mqfg

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do.

HIGH 73

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00428 Published 2024-10-28 No fix listed CWE-89

TI-2026-23397 CVE-2026-29909 · GHSA-72gm-vcvr-mjgq

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file…

MEDIUM 63

MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00451 Published 2026-03-30 No fix listed CWE-20

TI-2025-19131 CVE-2025-25768 · GHSA-h76r-mvr3-76xg

MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI)…

MEDIUM 60

MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java.

CVSS 3.1MEDIUM 5.4 Adjacent network No auth No interaction EPSS 0.00337 Published 2025-02-21 No fix listed CWE-77

TI-2024-16029 CVE-2024-24160 · GHSA-44vw-x4jf-3q2f

MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do.

MEDIUM 60

MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00434 Published 2024-02-02 No fix listed CWE-79

TI-2025-03856 CVE-2025-4327 · GHSA-gj49-w8v4-9qvv

MRCMS cross-site request forgery

MEDIUM 57

A vulnerability was found in MRCMS 3.1.2.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00301 Published 2025-05-06 No fix listed CWE-352

TI-2025-01923 CVE-2025-2193 · GHSA-rmxr-xm7j-cmg8

MRCMS org.marker.mushroom.controller.FileController delete.do delete path traversal

MEDIUM 57

A vulnerability has been found in MRCMS 3.1.2 and classified as critical.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00812 Published 2025-03-11 No fix listed CWE-22

TI-2025-01926 CVE-2025-2196 · GHSA-3gj6-xgvp-x3gj

MRCMS org.marker.mushroom.controller.FileController upload.do upload cross site scripting

MEDIUM 56

A vulnerability was found in MRCMS 3.1.2.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00409 Published 2025-03-11 No fix listed CWE-79

TI-2025-01925 CVE-2025-2195 · GHSA-2qxm-j67j-mv87

MRCMS org.marker.mushroom.controller.FileController rename.do rename cross site scripting

MEDIUM 56

A vulnerability was found in MRCMS 3.1.2.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00362 Published 2025-03-11 No fix listed CWE-79

TI-2025-01924 CVE-2025-2194 · GHSA-f8q4-8929-5859

MRCMS org.marker.mushroom.controller.FileController list.do list cross site scripting

MEDIUM 56

A vulnerability was found in MRCMS 3.1.2 and classified as problematic.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00362 Published 2025-03-11 No fix listed CWE-79

TI-2025-32169 CVE-2025-50581 · GHSA-gw6j-gjcx-2747

MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the…

MEDIUM 55

MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00216 Published 2025-07-18 No fix listed CWE-79

TI-2025-03855 CVE-2025-4326 · GHSA-rx4v-33p7-72qj

MRCMS Add Fragment Page add.do cross site scripting

MEDIUM 55

A vulnerability was found in MRCMS 3.1.2 and classified as problematic.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00343 Published 2025-05-06 No fix listed CWE-79

TI-2025-03854 CVE-2025-4325 · GHSA-9w6w-pc5p-c2cg

MRCMS Category Management Page add.do cross site scripting

MEDIUM 55

A vulnerability has been found in MRCMS 3.1.2 and classified as problematic.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00405 Published 2025-05-06 No fix listed CWE-79

TI-2025-03853 CVE-2025-4324 · GHSA-wjqg-m23v-986j

MRCMS External Link Management Page edit.do cross site scripting

MEDIUM 55

A vulnerability, which was classified as problematic, was found in MRCMS 3.1.2.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00343 Published 2025-05-06 No fix listed CWE-79

TI-2025-03852 CVE-2025-4323 · GHSA-6fcr-87qh-q4w5

MRCMS Edit Article Page cross site scripting

MEDIUM 55

A vulnerability, which was classified as problematic, has been found in MRCMS 3.1.2.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00343 Published 2025-05-06 No fix listed CWE-79

TI-2025-03822 CVE-2025-4293 · GHSA-45f6-6g3x-67c2

MRCMS Group Edit Page edit.do cross site scripting

MEDIUM 55

A vulnerability was found in MRCMS 3.1.3 and classified as problematic.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00343 Published 2025-05-05 No fix listed CWE-79

TI-2025-03821 CVE-2025-4292 · GHSA-4f46-w5m2-fwxq

MRCMS Edit User Page edit.do cross site scripting

MEDIUM 55

A vulnerability has been found in MRCMS 3.1.3 and classified as problematic.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00343 Published 2025-05-05 No fix listed CWE-79

TI-2024-16740 CVE-2024-25428 · GHSA-qxvg-pp92-xq57

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter.

LOW 35

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00395 Published 2024-02-20 No fix listed CWE-89

TI-2024-16030 CVE-2024-24161 · GHSA-ch4v-95r5-xc38

MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the…

LOW 34

MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00689 Published 2024-02-02 No fix listed CWE-552

TI-2025-19129 CVE-2025-25766 · GHSA-2p2q-7m86-j6ch

An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2…

LOW 24

An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00324 Published 2025-02-21 No fix listed CWE-77

TI-2025-19130 CVE-2025-25767 · GHSA-4hwx-j6w8-9w2r

A vertical privilege escalation vulnerability in the component…

LOW 22

A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00331 Published 2025-02-21 No fix listed CWE-266

TI-2025-19128 CVE-2025-25765 · GHSA-mw38-fx9m-f8jc

MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.

LOW 20

MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.

CVSS 3.1MEDIUM 4.0 Local No auth No interaction EPSS 0.00191 Published 2025-02-21 No fix listed

Open these records in search →