CVE-2025-25765

MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do...

CVE-2025-25768

The content management system MRCMS v3.1.2 contains a server-side template injection (SSTI) vulnerability within the ootstrap emplate emplate_engine.php (referenced as DispatcherServlet.java in some sources) component. This flaw allows an attacker to execute arbitrary code by submitting a crafte...

PT-2025-7574 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: The issue is related to a server-side template injection SSTI vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload. It is located in the component...

MRCMS 安全漏洞

MRCMS is a content management system by the individual developers of marker. A security vulnerability exists in MRCMS version v3.1.2, which stems from the /file/savefile.do module containing an arbitrary file upload vulnerability...

CVE-2025-25767

A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request...

CVE-2025-25765: Undefined Security Weakness

MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do...

CVE-2025-25766

The content management system MRCMS version 3.1.2 is susceptible to an arbitrary file upload vulnerability in the /file/savefile.do component. Attackers can exploit this by uploading a crafted .jsp file to execute arbitrary code. While no patch is currently available, it is recommended to restric...

CVE-2025-25765

The MRCMS content management system (version v3.1.2 ) contains an arbitrary file write vulnerability within the /file/save.do component. Attackers can exploit this API endpoint to write files to the server. While no patch is currently available, it is recommended to restrict access to the /file/s...

CVE-2025-25768: Improper Neutralization of Special Elements used in a Command

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

PT-2025-7573 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: A vertical privilege escalation issue in the /controller/UserController.java component allows attackers to delete users arbitrarily via a crafted request. Recommendations: For MRCMS version 3.1.2, consider...

CVE-2025-25767: Incorrect Privilege Assignment

A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request...

CVE-2025-25768

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2025-25765

MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do...

CVE-2025-25766

An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file...

CVE-2025-25768

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2025-25767

A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request...

CVE-2025-25767

A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request...

CVE-2025-25766

An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file...

CVE-2025-25765

MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do...

CVE-2025-25767

The content management system MRCMS v3.1.2 contains a vertical privilege escalation vulnerability within the /controller/UserController.java component. This flaw allows an attacker to arbitrarily delete users by sending a crafted request. As a temporary workaround, it is recommended to restrict a...