Vulnerabilities

TI-2025-32418 CVE-2025-51818 · GHSA-ggqw-h359-hvrr

MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component.

MEDIUM 60

MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00258 Published 2025-08-21 No fix listed CWE-552

TI-2025-32090 CVE-2025-50234 · GHSA-q8fh-wr43-3mgc

MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the…

MEDIUM 62

MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00294 Published 2025-08-06 No fix listed CWE-918

TI-2025-32383 CVE-2025-51651 · GHSA-5xj4-3cf7-r6mm

An authenticated arbitrary file download vulnerability in the component…

MEDIUM 58

An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.

CVSS 3.1MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00227 Published 2025-07-14 No fix listed CWE-598

TI-2025-04783 CVE-2025-5328 · GHSA-46f9-q7p3-mph9

chshcms mccms Backups.php restore_del path traversal

MEDIUM 57

A vulnerability was found in chshcms mccms 2.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01309 Published 2025-05-29 No fix listed CWE-22

TI-2025-04782 CVE-2025-5327 · GHSA-wjh7-pgpr-92w5

chshcms mccms Gf.php index server-side request forgery

MEDIUM 57

A vulnerability was found in chshcms mccms 2.7.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00564 Published 2025-05-29 No fix listed CWE-918

TI-2023-04631 CVE-2023-5029 · GHSA-vgx5-mfp7-c7qj

mccms 1 sql injection

LOW 39

A vulnerability, which was classified as critical, was found in mccms 2.6.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00641 Published 2023-09-17 No fix listed CWE-89

TI-2023-03032 CVE-2023-3236 · GHSA-crh3-rr47-6rc3

mccms Comic.php pic_save server-side request forgery

LOW 39

A vulnerability classified as critical has been found in mccms up to 2.6.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00701 Published 2023-06-14 No fix listed CWE-918

TI-2023-03031 CVE-2023-3235 · GHSA-p76q-8wfr-hpf8

mccms Comic.php pic_api server-side request forgery

LOW 39

A vulnerability was found in mccms up to 2.6.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00701 Published 2023-06-14 No fix listed CWE-918

TI-2023-14030 CVE-2023-29815 · GHSA-3w85-93xm-x7vx

mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).

HIGH 73

mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00295 Published 2023-04-28 No fix listed CWE-352

TI-2023-11774 CVE-2023-26782 · GHSA-q5wj-v48m-ch2m

An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service…

MEDIUM 62

An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security characters.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00872 Published 2023-04-28 No fix listed CWE-94

TI-2023-11773 CVE-2023-26781 · GHSA-3whv-7544-3cv4

SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL…

HIGH 82

SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0098 Published 2023-04-28 No fix listed CWE-89

TI-2022-12971 CVE-2022-30898 · GHSA-5wf5-w66w-qmrg

A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2…

LOW 30

A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00581 Published 2022-06-09 No fix listed CWE-352

TI-2022-12105 CVE-2022-29689 · GHSA-xhfv-xvjm-pqh5

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/del.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12104 CVE-2022-29688 · GHSA-v7mp-pvc5-pr33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/singer/hy.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12103 CVE-2022-29687 · GHSA-r93x-j3p7-8448

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/level_del.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12102 CVE-2022-29686 · GHSA-3rm2-x64w-wcx9

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/singer/admin/lists/zhuan.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12101 CVE-2022-29685 · GHSA-8c5h-pgpw-2c92

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

MEDIUM 40

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/User/level_sort.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0097 Published 2022-05-26 No fix listed CWE-89

TI-2022-12100 CVE-2022-29684 · GHSA-7rjc-f79q-gj8v

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/js_del.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12099 CVE-2022-29683 · GHSA-329x-5gjj-9v6c

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Label/page_del.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12098 CVE-2022-29682 · GHSA-679x-682p-m39r

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/vod/admin/topic/del.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12097 CVE-2022-29681 · GHSA-5qpw-8p73-jm26

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/Links/del.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12096 CVE-2022-29680 · GHSA-rpg7-hqjg-pxxj

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /admin.php/user/zu_del.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12095 CVE-2022-29676 · GHSA-rpgm-pm3h-88m4

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/lists/zhuan.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12094 CVE-2022-29670 · GHSA-7hcq-j54w-m8hw

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability…

LOW 33

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/del.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00957 Published 2022-05-26 No fix listed CWE-89

TI-2022-12093 CVE-2022-29669 · GHSA-w2rq-q2p4-c7qq

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability…

MEDIUM 40

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0097 Published 2022-05-26 No fix listed CWE-89

Vulnerabilities

Filters