705 matches found
Mingsoft MCMS < 5.3.1 - Cross-Site Scripting
A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotel...
Mingsoft MCMS v5.2.7 - SQL Injection
Mingsoft MCMS v5.2.7 contains an SQL injection vulnerability via /cms/content/list that allows unauthenticated attackers to execute arbitrary SQL commands on the affected database server. id: CVE-2022-26585 info: name: Mingsoft MCMS v5.2.7 - SQL Injection author: ritikchaddha severity: critical...
Mingsoft MCMS - SQL Injection
SQL injection vulnerability in Mingsoft MCMS up to 5.2.9 via the sqlWhere parameter in /cms/category/list. id: CVE-2022-4375 info: name: Mingsoft MCMS - SQL Injection author: ritikchaddha severity: critical description: | SQL injection vulnerability in Mingsoft MCMS up to 5.2.9 via the sqlWhere...
MCMS 5.2.5 - SQL Injection
MCMS 5.2.5 contains a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-23898 info:...
MCMS 5.2.4 - SQL Injection
MCMS 5.2.4 contains a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-25125 info: name: MCMS...
Mingsoft MCMS 5.2.9 - SQL Injection
Mingsoft MCMS v5.2.9 contains a SQL injection caused by unsanitized categoryType parameter at /content/list.do, letting attackers execute arbitrary SQL commands, exploit requires crafted input. id: CVE-2023-50578 info: name: Mingsoft MCMS 5.2.9 - SQL Injection author: ritikchaddha severity:...
CVE-2026-88416
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...
CVE-2026-88415
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...
CVE-2026-88414
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...
CVE-2026-88416
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...
CVE-2026-88416
The MCMS software versions 6.1.1 through 6.2.1 are susceptible to a SQL injection vulnerability within the custom model/form import feature . This flaw allows an attacker to insert malicious SQL statements into entry fields, potentially leading to unauthorized database access . While the vulnerab...
EUVD-2026-84858
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...
CVE-2026-88415
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...
PT-2026-96961
Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description SQL injection occurs in the 'PageAction.verify' endpoint GET '/ms/mdiy/page/verify.do'. SQL injection is a type of vulnerability that allows an attacker to interfere with the queries that an...
CVE-2026-88415: Improper Neutralization of Input During Web Page Generation
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...
CVE-2026-88415
Versions 6.1.1 through 6.2.1 of MCMS are vulnerable to stored Cross-Site Scripting (XSS) . The root cause is that the article content field contentDetails is excluded from the application's global XSS filter. The impact allows for the execution of malicious scripts in the context of the user's br...
PT-2026-97013
Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description Stored Cross-Site Scripting XSS occurs because the article content field contentDetails is excluded from the global XSS filter. Cross-Site Scripting is a flaw that allows an attacker to inject...
EUVD-2026-84809
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...
