Mcms

Source repositories

https://github.com/ming-soft/MCMS

CVEs (52)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2022-22930	Mingsoft Mcms	Cri	0.66	9.8	0.24	Jan 21, 2022	A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.
CVE-2025-29287	Mingsoft Mcms	Cri	0.64	9.8	0.01	Apr 21, 2025	An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2023-50578	Mingsoft Mcms	Cri	0.64	9.8	0.02	Dec 30, 2023	Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.
CVE-2020-20913	Mingsoft Mcms	Cri	0.64	9.8	0.01	Apr 4, 2023	SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.
CVE-2022-36599	Mingsoft Mcms	Cri	0.64	9.8	0.01	Aug 16, 2022	Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.
CVE-2022-36272	Mingsoft Mcms	Cri	0.64	9.8	0.01	Aug 16, 2022	Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.
CVE-2022-31943	Mingsoft Mcms	Cri	0.64	9.8	0.02	Jul 1, 2022	MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.
CVE-2022-30506	Mingsoft Mcms	Cri	0.64	9.8	0.03	Jun 2, 2022	An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.
CVE-2022-30048	Mingsoft Mcms	Cri	0.64	9.8	0.01	May 11, 2022	Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter.
CVE-2022-30047	Mingsoft Mcms	Cri	0.64	9.8	0.01	May 11, 2022	Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter.
CVE-2022-27466	Mingsoft Mcms	Cri	0.64	9.8	0.02	May 2, 2022	MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.
CVE-2022-26585	Mingsoft Mcms	Cri	0.64	9.8	0.06	Apr 5, 2022	Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
CVE-2021-46384	Mingsoft Mcms	Cri	0.64	9.8	0.02	Mar 4, 2022	https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated…
CVE-2022-25125	Mcms MCMS	Cri	0.64	9.8	0.07	Mar 3, 2022	MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
CVE-2022-23899	Mingsoft Mcms	Cri	0.64	9.8	0.01	Mar 3, 2022	MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.
CVE-2022-23898	Mingsoft Mcms	Cri	0.64	9.8	0.08	Mar 3, 2022	MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
CVE-2021-46036	Mingsoft Mcms	Cri	0.64	9.8	0.04	Feb 18, 2022	An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
CVE-2021-44868	Mingsoft Mcms	Cri	0.64	9.8	0.01	Feb 17, 2022	A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do
CVE-2021-46386	Mingsoft Mcms	Cri	0.64	9.8	0.03	Jan 26, 2022	File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.
CVE-2022-23315	Mingsoft Mcms	Cri	0.64	9.8	0.02	Jan 21, 2022	MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.

CVE-2022-22930CriJan 21, 2022
Mingsoft
Mcms
risk 0.66cvss 9.8epss 0.24
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.
CVE-2025-29287CriApr 21, 2025
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2023-50578CriDec 30, 2023
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.02
Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.
CVE-2020-20913CriApr 4, 2023
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.01
SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.
CVE-2022-36599CriAug 16, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.01
Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.
CVE-2022-36272CriAug 16, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.01
Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.
CVE-2022-31943CriJul 1, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.02
MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.
CVE-2022-30506CriJun 2, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.03
An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.
CVE-2022-30048CriMay 11, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.01
Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter.
CVE-2022-30047CriMay 11, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.01
Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter.
CVE-2022-27466CriMay 2, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.02
MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.
CVE-2022-26585CriApr 5, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.06
Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
CVE-2021-46384CriMar 4, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.02
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated…
CVE-2022-25125CriMar 3, 2022
Mcms
MCMS
risk 0.64cvss 9.8epss 0.07
MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
CVE-2022-23899CriMar 3, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.01
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.
CVE-2022-23898CriMar 3, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.08
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
CVE-2021-46036CriFeb 18, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.04
An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
CVE-2021-44868CriFeb 17, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.01
A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do
CVE-2021-46386CriJan 26, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.03
File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.
CVE-2022-23315CriJan 21, 2022
Mingsoft
Mcms
risk 0.64cvss 9.8epss 0.02
MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.

Page 1 of 3