16 matches found
SQL Injection
net.mingsoft, ms-mcms is vulnerable to SQL Injection. The vulnerability is due to improper input sanitization in the search.do endpoint within the /web/MCmsAction.java file, which allows an attacker to inject malicious SQL queries and manipulate or access unauthorized database information...
Arbitrary File Upload
net.mingsoft, ms-mcms is vulnerable to Arbitrary File Upload. The vulnerability is due to insufficient validation of uploaded files in MCMS, allowing attackers to upload and execute crafted files, leading to remote code execution...
net.mingsoft:ms-mdiy (1.0.10), net.mingsoft:ms-mpeople (1.0.10) +1 more potentially affected by CVE-2024-33748 via net.mingsoft:ms-basic (1.0.14)
net.mingsoft:ms-basic MAVEN version 1.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on net.mingsoft:ms-basic and may be impacted: - net.mingsoft:ms-mdiy 1.0.10 - net.mingsoft:ms-mpeople 1.0.10 - net.mingsoft:ms-upgrader 1.0.11 Source cves:...
CVE-2024-33748
Cross-site scripting XSS vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier...
CVE-2024-33748
Cross-site scripting XSS vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier...
CVE-2024-33748: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier...
CVE-2024-33748
Cross-site scripting XSS vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier...
Arbitrary File Write
net.mingsoft:ms-mcms is vulnerable to Arbitrary File Write. An authenticated attacker is able to cause an arbitrary file write via the ms/template/writeFileContent.do component due to unrestricted file upload...
net.mingsoft:ms-base (>=1.0.3, <=1.0.8), net.mingsoft:ms-basic (>=1.0.5, <=1.0.7) +8 more potentially affected by CVE-2023-24162 via cn.hutool:hutool-all (4.0.3)
cn.hutool:hutool-all MAVEN version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-all and may be impacted: - net.mingsoft:ms-base =1.0.3, =1.0.5, =1.0.0, =4.6.3-snapshots, =1.0.4, =1.0.0, =1.0.4, =1.0.0, =1.0.4 -...
GHSA-65V6-3C9M-HMRP Arbitrary file write in net.mingsoft:ms-mcms
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do...
Arbitrary file write in net.mingsoft:ms-mcms
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do...
SQL Injection
net.mingsoft, ms-mcms is vulnerable to SQL injection. The vulnerability exists due to improper sanitization in the get function of categoryaction.java due to manipulation in the argument sqlWhere, via the /cms/category/list endpoint...
Remote code execution in net.mingsoft:ms-mcms
net.mingsoft:ms-mcms =5.2.5 is affected by: RCE. The impact is: execute arbitrary code remote. The attack vector is: $"freemarker.template.utility.Execute"?new"calc". ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise...
SQL injection in net.mingsoft:ms-mcms
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java...