CVE-2025-25766

An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file...

CVE-2025-25768

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2025-25765

MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do...

CVE-2025-25767

CVE-2025-25767 describes a vertical privilege escalation in MRCMS v3.1.2, specifically in the /controller/UserController.java component. The vulnerability allows an attacker to arbitrarily delete users via a crafted request. Reported details indicate a fixed/mitigation status is not provided in t...

CVE-2024-48177

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do...

CVE-2024-48177

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do...

CVE-2024-48177

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do...

CVE-2024-48177

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do...

CVE-2024-48177

Affected product: MRCMS 3.1.2. Vulnerability: SQL injection via the RID parameter in /admin/article/delete.do. Root cause implied by description: unsafe handling of RID enabling injection. Impact (per CVSS): CVSSv3.1 base score 8.8 (HIGH) with Network attack vector, low attack complexity, privile...

CVE-2024-25428

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

Sql injection

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

CVE-2024-25428

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

CVE-2024-25428

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

CVE-2024-25428

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

CVE-2024-25428

CVE-2024-25428 affects MRCMS v3.1.2 where the status parameter is vulnerable to SQL injection, enabling an attacker to run arbitrary system commands. Root cause: improper input handling leading to SQL injection. Impact per available data: potential command execution with network access, no user i...

CVE-2024-24160

MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...

CVE-2024-24160

MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...

CVE-2024-24161

MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered...

Cross site scripting

MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...

Remote file inclusion

MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered...