Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
MingsoftMcms

27 matches found

CVE
CVE•added 2022/01/21 12:15 a.m.•137 views

CVE-2022-23315

MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.

9.8CVSS9.6AI score0.00678EPSS
CVE
CVE•added 2022/01/21 12:15 a.m.•115 views

CVE-2022-22928

MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code.

9.8CVSS9.7AI score0.02316EPSS
CVE
CVE•added 2022/03/03 7:15 p.m.•104 views

CVE-2022-23898

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.

9.8CVSS9.8AI score0.82815EPSS
CVE
CVE•added 2022/04/05 1:15 a.m.•104 views

CVE-2022-26585

Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.

9.8CVSS9.8AI score0.17904EPSS
CVE
CVE•added 2022/02/18 8:15 p.m.•103 views

CVE-2021-46063

MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.

9.1CVSS9.3AI score0.10255EPSS
CVE
CVE•added 2022/03/04 10:15 p.m.•103 views

CVE-2021-46384

https://gitee.com/mingSoft/MCMS MCMS

9.8CVSS9.5AI score0.09689EPSS
CVE
CVE•added 2022/03/03 7:15 p.m.•100 views

CVE-2022-25125

MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.

9.8CVSS9.8AI score0.84696EPSS
CVE
CVE•added 2022/02/18 7:15 p.m.•97 views

CVE-2021-46036

An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.

9.8CVSS9.7AI score0.10278EPSS
CVE
CVE•added 2022/01/21 12:15 a.m.•91 views

CVE-2022-23314

MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do.

9.8CVSS9.8AI score0.00402EPSS
CVE
CVE•added 2022/06/02 2:15 p.m.•91 views

CVE-2022-30506

An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.

9.8CVSS9.6AI score0.02519EPSS
CVE
CVE•added 2022/03/03 7:15 p.m.•89 views

CVE-2022-23899

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.

9.8CVSS9.8AI score0.00233EPSS
CVE
CVE•added 2022/02/17 4:15 p.m.•85 views

CVE-2021-44868

A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do

9.8CVSS9.5AI score0.00505EPSS
CVE
CVE•added 2022/08/16 1:15 p.m.•77 views

CVE-2022-36272

Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.

9.8CVSS9.8AI score0.00212EPSS
CVE
CVE•added 2025/04/21 3:15 p.m.•77 views

CVE-2025-29287

An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.

9.8CVSS7.8AI score0.00107EPSS
CVE
CVE•added 2022/01/21 12:15 a.m.•76 views

CVE-2022-22929

MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.

9.8CVSS9.6AI score0.02652EPSS
CVE
CVE•added 2022/08/16 1:15 p.m.•76 views

CVE-2022-36599

Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.

9.8CVSS9.8AI score0.00286EPSS
CVE
CVE•added 2022/07/01 9:15 p.m.•70 views

CVE-2022-31943

MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.

9.8CVSS9.3AI score0.00364EPSS
CVE
CVE•added 2022/05/02 2:15 p.m.•66 views

CVE-2022-27466

MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.

9.8CVSS9.7AI score0.00381EPSS
CVE
CVE•added 2018/10/30 6:29 a.m.•62 views

CVE-2018-18830

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept ...

9.8CVSS9.7AI score0.00433EPSS
CVE
CVE•added 2022/05/11 6:15 p.m.•59 views

CVE-2022-30048

Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter.

9.8CVSS9.8AI score0.00355EPSS
CVE
CVE•added 2022/12/09 8:15 a.m.•58 views

CVE-2022-4375

A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed ...

9.8CVSS8.3AI score0.49341EPSS
CVE
CVE•added 2022/05/11 6:15 p.m.•57 views

CVE-2022-30047

Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter.

9.8CVSS9.8AI score0.00355EPSS
CVE
CVE•added 2021/01/26 6:15 p.m.•54 views

CVE-2020-23262

An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.

9.8CVSS9.8AI score0.00264EPSS
CVE
CVE•added 2022/01/21 12:15 a.m.•50 views

CVE-2022-22930

A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.

9.8CVSS9.7AI score0.18145EPSS
CVE
CVE•added 2022/01/26 5:15 p.m.•48 views

CVE-2021-46386

File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.

9.8CVSS9.6AI score0.06397EPSS
CVE
CVE•added 2023/04/04 3:15 p.m.•42 views

CVE-2020-20913

SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.

9.8CVSS9.8AI score0.03613EPSS
CVE
CVE•added 2023/12/30 4:15 p.m.•29 views

CVE-2023-50578

Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.

9.8CVSS9.8AI score0.00269EPSS