631 matches found
Mingsoft MCMS 5.2.9 - SQL Injection
Mingsoft MCMS v5.2.9 contains a SQL injection caused by unsanitized categoryType parameter at /content/list.do, letting attackers execute arbitrary SQL commands, exploit requires crafted input. id: CVE-2023-50578 info: name: Mingsoft MCMS 5.2.9 - SQL Injection author: ritikchaddha severity:...
MCMS 5.2.5 - SQL Injection
MCMS 5.2.5 contains a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-23898 info:...
Mingsoft MCMS v5.2.7 - SQL Injection
Mingsoft MCMS v5.2.7 contains an SQL injection vulnerability via /cms/content/list that allows unauthenticated attackers to execute arbitrary SQL commands on the affected database server. id: CVE-2022-26585 info: name: Mingsoft MCMS v5.2.7 - SQL Injection author: ritikchaddha severity: critical...
MCMS 5.2.4 - SQL Injection
MCMS 5.2.4 contains a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-25125 info: name: MCMS...
Mingsoft MCMS - SQL Injection
SQL injection vulnerability in Mingsoft MCMS up to 5.2.9 via the sqlWhere parameter in /cms/category/list. id: CVE-2022-4375 info: name: Mingsoft MCMS - SQL Injection author: ritikchaddha severity: critical description: | SQL injection vulnerability in Mingsoft MCMS up to 5.2.9 via the sqlWhere...
Mingsoft MCMS < 5.3.1 - Cross-Site Scripting
A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotel...
CVE-2026-88416
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...
CVE-2026-88414
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...
CVE-2026-88415
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...
PT-2026-97031
Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description A SQL injection issue exists within the custom model/form import feature. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially...
PT-2026-97013
Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description Stored Cross-Site Scripting XSS occurs because the article content field contentDetails is excluded from the global XSS filter. Cross-Site Scripting is a flaw that allows an attacker to inject...
EUVD-2026-84858
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...
EUVD-2026-84810
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...
CVE-2026-88414: Improper Neutralization of Special Elements used in an SQL Command
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint GET /ms/mdiy/page/verify.do...
CVE-2026-88416: Undefined Security Weakness
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature...
CVE-2026-88415
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...
CVE-2026-88414
Versions 6.1.1 through 6.2.1 of MCMS are affected by a SQL injection vulnerability located in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do). The vulnerability allows for unauthorized interaction with the backend database. While the technical impact is rated as critical with high sc...
PT-2026-96961
Name of the Vulnerable Software and Affected Versions MCMS versions 6.1.1 through 6.2.1 Description SQL injection occurs in the 'PageAction.verify' endpoint GET '/ms/mdiy/page/verify.do'. SQL injection is a type of vulnerability that allows an attacker to interfere with the queries that an...
CVE-2026-88415: Improper Neutralization of Input During Web Page Generation
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting XSS. The article content field contentDetails is excluded from the global XSS filter...