CVE-2022-22930

A remote code execution RCE vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload...

CVE-2022-23314

MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do...

CVE-2022-23315

MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do...

CVE-2022-22928

MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code...

Hardcoded credentials

MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code...

Remote code execution

A remote code execution RCE vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload...

Privilege escalation

MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do...

Sql injection

MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do...

CVE-2022-22930

MCMS v5.2.4 Template Management is affected by an RCE vulnerability. The issue stems from insufficient input handling in the Template Management function, enabling an attacker to execute arbitrary code via a crafted payload. Multiple connected sources (Red Hat, GHSA, CNVD, CNNVD, NVD, etc.) descr...

CVE-2022-23315

MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do...

CVE-2022-23315

MCMS v5.2.4 is affected by an arbitrary file upload vulnerability in the component /ms/template/writeFileContent.do. The root cause, as described across connected sources, is insufficient validation/filtration of uploaded file types, enabling attackers to upload arbitrary files. This impacts conf...

CVE-2022-23314

Affected product. MCMS v5.2.4. Vulnerability. SQL injection via /ms/mdiy/model/importJson.do. Root cause: lack of filtering/escaping of SQL data (per CNVD/CNNVD/Red Hat entries). Impact. High severity (CVSS v3.1: 9.8; CVSS v2.0: 7.5) with network access, no authentication, and full impact on conf...

CVE-2022-22929

MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file...

CVE-2022-22929

CVE-2022-22929 affects MingSoft MCMS v5.2.4, with an arbitrary file upload vulnerability in the New Template module. The vulnerability enables remote code execution via a crafted ZIP file, based on the description in multiple connected sources. Exploitation details, affected versions beyond v5.2....

CVE-2022-22928

MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code...

CVE-2022-22928

CVE-2022-22928 concerns MingSoft MCMS v5.2.4, where a hardcoded Shiro key is the root cause. This enables attackers to exploit the key and execute arbitrary code. Available references from NVD and vendor CNVD/Red Hat entries corroborate a remote, unauthenticated impact with high to critical sever...

Siemens SCALANCE X-200 < v5.2.4, XP/XC/XF-200 < v4.1, X-300 all versions (ICSA-19-085-01)

Binary data 720273.prm...

jspxcms admin backend login page cross-site scripting vulnerability

jspxcms is an open source, Java-based content management system CMS. A cross-site scripting vulnerability exists in the administration backend login page of jspxcms version v5.2.4, due to analyzing the search box on the front page of Jspxcms for user inputs that are not input filtered. This...