Mrcms
by Mrcms
CVEs (23)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-31272 | Cri | 0.64 | 9.8 | 0.01 | Apr 7, 2026 | MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper authorization validation, enabling direct addition of super administrator accounts without authentication. | ||
| CVE-2018-17796 | Cri | 0.64 | 9.8 | 0.02 | Sep 30, 2018 | An issue was discovered in MRCMS (aka mushroom) through 3.1.2. The WebParam.java file directly accepts the FIELD_T parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel() in the… | ||
| CVE-2024-48177 | Hig | 0.57 | 8.8 | 0.00 | Oct 28, 2024 | MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do. | ||
| CVE-2024-24161 | Hig | 0.49 | 7.5 | 0.01 | Feb 2, 2024 | MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered. | ||
| CVE-2024-25428 | Med | 0.42 | 6.5 | 0.00 | Feb 20, 2024 | SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter. | ||
| CVE-2025-2193 | Med | 0.35 | 5.4 | 0.01 | Mar 11, 2025 | A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path/name leads to path… | ||
| CVE-2025-25768 | Med | 0.35 | 5.4 | 0.00 | Feb 21, 2025 | MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload. | ||
| CVE-2024-24160 | Med | 0.35 | 5.4 | 0.00 | Feb 2, 2024 | MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do. | ||
| CVE-2026-29909 | Med | 0.34 | 5.3 | 0.00 | Mar 30, 2026 | MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate directory contents on the server without… | ||
| CVE-2025-50581 | Med | 0.31 | 4.8 | 0.00 | Jul 18, 2025 | MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do. | ||
| CVE-2025-25767 | Med | 0.31 | 4.8 | 0.00 | Feb 21, 2025 | A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request. | ||
| CVE-2025-25766 | Med | 0.31 | 4.8 | 0.00 | Feb 21, 2025 | An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file. | ||
| CVE-2025-4327 | Med | 0.28 | 4.3 | 0.00 | May 6, 2025 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.… | ||
| CVE-2025-25765 | Med | 0.26 | 4.0 | 0.00 | Feb 21, 2025 | MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do. | ||
| CVE-2025-2196 | Low | 0.23 | 3.5 | 0.00 | Mar 11, 2025 | A vulnerability was found in MRCMS 3.1.2. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /admin/file/upload.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path leads to… | ||
| CVE-2025-2195 | Low | 0.23 | 3.5 | 0.00 | Mar 11, 2025 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is the function rename of the file /admin/file/rename.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument name/path leads to cross site… | ||
| CVE-2025-2194 | Low | 0.23 | 3.5 | 0.00 | Mar 11, 2025 | A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects the function list of the file /admin/file/list.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path leads to cross site scripting. The… | ||
| CVE-2025-4326 | Low | 0.16 | 2.4 | 0.00 | May 6, 2025 | A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects some unknown processing of the file /admin/chip/add.do of the component Add Fragment Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit… | ||
| CVE-2025-4325 | Low | 0.16 | 2.4 | 0.00 | May 6, 2025 | A vulnerability has been found in MRCMS 3.1.2 and classified as problematic. This vulnerability affects unknown code of the file /admin/category/add.do of the component Category Management Page. The manipulation of the argument Name leads to cross site scripting. The attack can… | ||
| CVE-2025-4324 | Low | 0.16 | 2.4 | 0.00 | May 6, 2025 | A vulnerability, which was classified as problematic, was found in MRCMS 3.1.2. This affects an unknown part of the file /admin/link/edit.do of the component External Link Management Page. The manipulation leads to cross site scripting. It is possible to initiate the attack… |
- risk 0.64cvss 9.8epss 0.01
MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper authorization validation, enabling direct addition of super administrator accounts without authentication.
- risk 0.64cvss 9.8epss 0.02
An issue was discovered in MRCMS (aka mushroom) through 3.1.2. The WebParam.java file directly accepts the FIELD_T parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel() in the…
- risk 0.57cvss 8.8epss 0.00
MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do.
- risk 0.49cvss 7.5epss 0.01
MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered.
- risk 0.42cvss 6.5epss 0.00
SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter.
- risk 0.35cvss 5.4epss 0.01
A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path/name leads to path…
- risk 0.35cvss 5.4epss 0.00
MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
- risk 0.35cvss 5.4epss 0.00
MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do.
- risk 0.34cvss 5.3epss 0.00
MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate directory contents on the server without…
- risk 0.31cvss 4.8epss 0.00
MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do.
- risk 0.31cvss 4.8epss 0.00
A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request.
- risk 0.31cvss 4.8epss 0.00
An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
- risk 0.28cvss 4.3epss 0.00
A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.…
- risk 0.26cvss 4.0epss 0.00
MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.
- risk 0.23cvss 3.5epss 0.00
A vulnerability was found in MRCMS 3.1.2. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /admin/file/upload.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path leads to…
- risk 0.23cvss 3.5epss 0.00
A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is the function rename of the file /admin/file/rename.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument name/path leads to cross site…
- risk 0.23cvss 3.5epss 0.00
A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects the function list of the file /admin/file/list.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path leads to cross site scripting. The…
- risk 0.16cvss 2.4epss 0.00
A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects some unknown processing of the file /admin/chip/add.do of the component Add Fragment Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit…
- risk 0.16cvss 2.4epss 0.00
A vulnerability has been found in MRCMS 3.1.2 and classified as problematic. This vulnerability affects unknown code of the file /admin/category/add.do of the component Category Management Page. The manipulation of the argument Name leads to cross site scripting. The attack can…
- risk 0.16cvss 2.4epss 0.00
A vulnerability, which was classified as problematic, was found in MRCMS 3.1.2. This affects an unknown part of the file /admin/link/edit.do of the component External Link Management Page. The manipulation leads to cross site scripting. It is possible to initiate the attack…
Page 1 of 2