540 matches found
SQL Injection Vulnerability in MCms
MCms is a complete open source content management system. MCms suffers from a SQL injection vulnerability. Attackers can exploit the vulnerability to obtain sensitive information in the database...
Jiangxi Minsoft Technology Co., Ltd. MCms foreground has a logic flaw vulnerability
Jiangxi Minsoft Technology Co., Ltd. business scope includes: information technology consulting services; Internet information services; computer software technology development and so on. Jiangxi MingSoft Technology Co., Ltd. MCms foreground there is a logic flaw vulnerability, an attacker can u...
File upload vulnerability in MCms backend of Jiangxi Minsoft Technology Co.
Jiangxi Minsoft Technology Co., Ltd. business scope includes: information technology consulting services; Internet information services; computer software technology development and so on. Jiangxi Minsoft Technology Co., Ltd. MCms background file upload vulnerability, attackers can use the...
File upload vulnerability in MCms backend of Jiangxi Minsoft Technology Co. Ltd (CNVD-2020-64532)
Jiangxi Minsoft Technology Co., Ltd. business scope includes: information technology consulting services; Internet information services; computer software technology development and so on. Jiangxi Minsoft Technology Co., Ltd. MCms background file upload vulnerability, attackers can use the...
File upload vulnerability in MCMS frontend up***.do page
MCMS is a website building system of MINGFEI TECHNOLOGY CO. A file upload vulnerability exists in the MCMS frontend up.do page. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...
File Upload Vulnerability in MCMS Backend
MCMS is a website building system of MINGFEI TECHNOLOGY CO. A file upload vulnerability exists in the MCMS backend. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...
SQL Injection Vulnerability in Mcms of Jingdezhen Mingfei Technology Co.
Mcms is a J2EE system. Jingdezhen Mingfei Technology Co., Ltd Mcms has a SQL injection vulnerability that can be exploited by an attacker to obtain sensitive information from the database...
Mcms has a file upload vulnerability (CNVD-2020-27934)
Mcms is a web site building system of MINGFEI TECHNOLOGY CO. Mcms suffers from a file upload vulnerability that can be exploited by an attacker to gain server administrator privileges...
File Upload Vulnerability in Mcms
Mcms is a web site building system of MINGFEI TECHNOLOGY CO. Mcms suffers from a file upload vulnerability that can be exploited by an attacker to gain webmaster privileges...
Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms
An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...
GHSA-7HJP-97G3-RQ93 Path Traversal in minsoft:ms-mcms
An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file in the position parameter to an arbitrary directory via a ../ Directory Traversal in the url parameter...
Path Traversal in minsoft:ms-mcms
An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file in the position parameter to an arbitrary directory via a ../ Directory Traversal in the url parameter...
Remote Code Execution (RCE)
ms-mcms is vulnerable to a remote code execution RCE attack. The application does not verify user login statuses, allowing a malicious user to upload jsp files with .png filenames to inject and execute arbitrary JSP code...
Arbitrary File Write
ms-mcms is vulnerable to arbitrary file write attacks. The vulnerability exists in com/mingsoft/cms/action/GeneraterAction.java where the value of the url parameter could be used to specify arbitrary .jsp files to be written...
CVE-2018-18831
An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file in the position parameter to an arbitrary directory via a ../ Directory Traversal in the url parameter...
Design/Logic Flaw
An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...
CVE-2018-18830
An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...
Directory traversal
An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file in the position parameter to an arbitrary directory via a ../ Directory Traversal in the url parameter...
CVE-2018-18830
An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...
CVE-2018-18830
MCMS 4.6.5 is affected by a flaw in com\mingsoft\basic\action\web\FileAction.java where the upload interface does not verify login status, allowing an attacker to upload JSP content disguised as a .png file and then coerce a suffix change to .jsp to access a stored path and execute arbitrary JSP ...