CVE-2025-25766

An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file...

CVE-2025-25768

MRCMS v3.1.2 was discovered to contain a server-side template injection SSTI vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2025-25766: Improper Neutralization of Special Elements used in a Command

An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file...

CVE-2024-48177

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do...

CVE-2024-48177

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do...

CVE-2024-48177

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do...

CVE-2024-48177: Improper Neutralization of Special Elements used in an SQL Command

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do...

CVE-2024-48177

MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do...

CVE-2024-48177

The content management system MRCMS version 3.1.2 is vulnerable to a SQL injection vulnerability. The flaw exists in the RID parameter located at the /admin/article/delete.do endpoint. This vulnerability allows an attacker to interfere with backend database queries, potentially leading to unautho...

CVE-2024-25428

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

Sql injection

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

CVE-2024-25428

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

CVE-2024-25428

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

CVE-2024-25428

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

CVE-2024-25428

The MRCMS content management system (version 3.1.2 ) is susceptible to an SQL Injection vulnerability via the status parameter. This flaw allows an attacker to execute arbitrary system commands , potentially leading to unauthorized access and control. As a mitigation, users should avoid using the...

CVE-2024-25428: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

CVE-2024-24160

MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...

CVE-2024-24160

MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...

CVE-2024-24161

MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered...

Cross site scripting

MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...