Vulnerabilities

TI-2026-15792 CVE-2026-19357 · GHSA-mr8h-hjph-4g54

MingSoft MCMS ms-mdiy get information disclosure

HIGH 70

A security flaw has been discovered in MingSoft MCMS up to 3.0.6.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00483 Published 2026-08-09 No fix listed CWE-200

TI-2026-15791 CVE-2026-19356 · GHSA-7553-w66v-fvhr

MingSoft MCMS ms-mdiy list information disclosure

HIGH 70

A vulnerability was identified in MingSoft MCMS up to 3.0.6.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00483 Published 2026-08-09 No fix listed CWE-200

TI-2026-15790 CVE-2026-19355 · GHSA-mgf9-vmjp-7q9v

MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection

LOW 37

A vulnerability was determined in MingSoft MCMS up to 3.0.6.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00411 Published 2026-08-09 No fix listed CWE-74

TI-2026-04315 CVE-2026-4954 · GHSA-9cf6-cmjx-857j

mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection

MEDIUM 57

A security vulnerability has been detected in mingSoft MCMS up to 5.5.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.002 Published 2026-03-27 No fix listed CWE-74

TI-2026-04314 CVE-2026-4953 · GHSA-xmm3-9x39-98r5

mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery

HIGH 70

A weakness has been identified in mingSoft MCMS up to 5.5.0.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00289 Published 2026-03-27 No fix listed CWE-918

TI-2026-02278 CVE-2026-2666 · GHSA-r9wp-qq53-qvjx

mingSoft MCMS Template Archive uploadTemplate.do unrestricted upload

MEDIUM 56

A flaw has been found in mingSoft MCMS 6.1.1.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00411 Published 2026-02-18 No fix listed CWE-284

TI-2025-37835 CVE-2025-60837 · GHSA-wvv5-5g6x-hp7j

A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to…

LOW 27

A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00204 Published 2025-10-23 No fix listed CWE-79

TI-2025-35306 CVE-2025-56316 · GHSA-54wc-49qj-5ghj

A SQL injection vulnerability in the content_title parameter of the /cms/content/list…

MEDIUM 50

A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rende…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00636 Published 2025-10-17 Fixed in 6.0.2 CWE-89

TI-2025-37836 CVE-2025-60838 · GHSA-p4gr-x7c7-6f67

An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute…

LOW 30

An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00263 Published 2025-10-10 No fix listed CWE-77

TI-2025-21032 CVE-2025-29287 · GHSA-3922-2r6r-r4fv

An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows…

HIGH 82

An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00792 Published 2025-04-21 Fixed in 5.4.4 CWE-434

TI-2024-28714 CVE-2024-42991 · GHSA-67qh-39h4-8p22

MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.

HIGH 70

MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00806 Published 2024-09-03 No fix listed CWE-434

TI-2024-15068 CVE-2024-22567 · GHSA-7qw4-9r68-2rmx

File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via…

HIGH 71

File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.17789 Published 2024-02-05 No fix listed CWE-434

TI-2023-27967 CVE-2023-51282 · GHSA-h57w-vh34-f8cw

An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive…

HIGH 66

An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01119 Published 2024-01-16 No fix listed CWE-94

TI-2023-27629 CVE-2023-50578 · GHSA-3vvh-8c65-32j4

Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the…

HIGH 82

Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0224 Published 2023-12-30 No fix listed CWE-89

TI-2023-03705 CVE-2023-3990 · GHSA-rxvj-5mv6-j5mc

Mingsoft MCMS HTTP POST Request search.do cross site scripting

LOW 30

A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01432 Published 2023-07-28 Fixed in 5.3.2 CWE-79

TI-2020-14389 CVE-2020-22755 · GHSA-293v-5329-36wp

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a…

HIGH 73

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00924 Published 2023-05-08 No fix listed CWE-434

TI-2020-13941 CVE-2020-20913 · GHSA-hx8p-9m48-g76r

SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to…

HIGH 82

SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01423 Published 2023-04-04 Fixed in 5.1 CWE-89

TI-2022-23293 CVE-2022-47042 · GHSA-65v6-3c9m-hmrp

MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability…

HIGH 73

MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01036 Published 2023-01-24 Fixed in 5.2.11 CWE-434

TI-2022-04240 CVE-2022-4640 · GHSA-6rvv-h8g7-728w

Mingsoft MCMS Article save cross site scripting

HIGH 66

A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00435 Published 2022-12-21 No fix listed CWE-707

TI-2022-04007 CVE-2022-4375 · GHSA-hc5g-xf64-j49j

Mingsoft MCMS list sql injection

HIGH 75

A vulnerability was found in Mingsoft MCMS up to 5.2.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0315 Published 2022-12-09 Fixed in 5.2.10 CWE-707

TI-2022-03983 CVE-2022-4350 · GHSA-p46c-m4j7-mjvq

Mingsoft MCMS search.do cross site scripting

MEDIUM 60

A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00425 Published 2022-12-08 No fix listed CWE-707

TI-2022-16900 CVE-2022-36599 · GHSA-w3rc-2whg-w934

Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.

MEDIUM 44

Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01101 Published 2022-08-16 No fix listed CWE-89

TI-2022-16632 CVE-2022-36272 · GHSA-hmj3-mqgw-2fq6

Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in…

MEDIUM 44

Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01101 Published 2022-08-16 No fix listed CWE-89

TI-2022-13744 CVE-2022-31943 · GHSA-4828-473v-37gh

MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.

MEDIUM 45

MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0152 Published 2022-07-01 No fix listed CWE-434

TI-2022-12074 CVE-2022-29647 · GHSA-gp39-qj5f-43qv

An issue was discovered in MCMS 5.2.7.

LOW 39

An issue was discovered in MCMS 5.2.7.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00658 Published 2022-05-31 No fix listed CWE-352

Vulnerabilities

Filters