14 matches found
SQL Injection
net.mingsoft, ms-mcms is vulnerable to SQL Injection. The vulnerability is due to improper input sanitization in the search.do endpoint within the /web/MCmsAction.java file, which allows an attacker to inject malicious SQL queries and manipulate or access unauthorized database information...
Arbitrary File Upload
net.mingsoft, ms-mcms is vulnerable to Arbitrary File Upload. The vulnerability is due to insufficient validation of uploaded files in MCMS, allowing attackers to upload and execute crafted files, leading to remote code execution...
CVE-2024-33748
Cross-site scripting XSS vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier...
CVE-2024-33748
Cross-site scripting XSS vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier...
CVE-2024-33748: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier...
CVE-2024-33748
Cross-site scripting XSS vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier...
Arbitrary File Write
net.mingsoft:ms-mcms is vulnerable to Arbitrary File Write. An authenticated attacker is able to cause an arbitrary file write via the ms/template/writeFileContent.do component due to unrestricted file upload...
Arbitrary file write in net.mingsoft:ms-mcms
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do...
GHSA-65V6-3C9M-HMRP Arbitrary file write in net.mingsoft:ms-mcms
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do...
SQL Injection
net.mingsoft, ms-mcms is vulnerable to SQL injection. The vulnerability exists due to improper sanitization in the get function of categoryaction.java due to manipulation in the argument sqlWhere, via the /cms/category/list endpoint...
Remote code execution in net.mingsoft:ms-mcms
net.mingsoft:ms-mcms =5.2.5 is affected by: RCE. The impact is: execute arbitrary code remote. The attack vector is: $"freemarker.template.utility.Execute"?new"calc". ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise...
SQL injection in net.mingsoft:ms-mcms
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml...