PT-2024-20305 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.0 Description: The issue is related to an Arbitrary File Read vulnerability. It affects the /admin/file/edit.do endpoint, where the incoming path parameter is not properly filtered. This allows for unauthorized access to files...

CVE-2024-24160

MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...

CVE-2024-24161

MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered...

CVE-2024-24161

MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered...

CVE-2024-24161

CVE-2024-24161 affects MRCMS 3.0 with an Arbitrary File Read vulnerability in the /admin/file/edit.do endpoint, caused by an unfiltered incoming path parameter. Public details report the issue derives from an unfiltered path parameter and assign a CVSS v3.1 base score of 7.5 (HIGH) with network a...

CVE-2024-24160

MRCMS 3.0 contains a Cross-Site Scripting XSS vulnerability via /admin/system/saveinfo.do...

CVE-2024-24160

MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do. The connected sources confirm the affected software/version and the vulnerable endpoint but do not provide concrete exploitation details, impact scope beyond XSS, or remediation steps. No additional explo...

CVE-2018-17796

An issue was discovered in MRCMS aka mushroom through 3.1.2. The WebParam.java file directly accepts the FIELDT parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel in the ChannelService.java file...

Sql injection

An issue was discovered in MRCMS aka mushroom through 3.1.2. The WebParam.java file directly accepts the FIELDT parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel in the ChannelService.java file...

CVE-2018-17796

An issue was discovered in MRCMS aka mushroom through 3.1.2. The WebParam.java file directly accepts the FIELDT parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel in the ChannelService.java file...

CVE-2018-17796

An issue was discovered in MRCMS aka mushroom through 3.1.2. The WebParam.java file directly accepts the FIELDT parameter in a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in getChannel in the ChannelService.java file...

CVE-2018-17796

CVE-2018-17796 affects MRCMS (aka mushroom) up to version 3.1.2. The WebParam.java file directly accepts the FIELD_T parameter from a request and uses it as a hash of SQL statements without filtering, resulting in a SQL injection vulnerability in ChannelService.getChannel(). This is supported by ...