Skip to content
OpenAdvisories

Package · Maven

net.mingsoft:ms-mcms

39 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-56316

    MCMS vulnerable SQL injection via the content_title parameter

    A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2025-29287

    MCMS allows arbitrary file uploads in the ueditor component

    An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2023-50578 Scanner template

    Mingsoft MCMS SQL injection

    Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2020-20913

    Ming-Soft MCMS vulnerable to SQL injection

    SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2022-36599

    Mingsoft MCMS SQL injection vulnerability in /mdiy/model/delete URI via models List

    Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2022-36272

    Mingsoft MCMS SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter

    Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2022-31943

    Unrestricted Upload of File with Dangerous Type in MCMS

    MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2022-30506

    Code injection in MCMS

    An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2021-46384

    Remote code execution in net.mingsoft:ms-mcms

    https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unaut…

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2022-23899

    SQL injection in net.mingsoft:ms-mcms

    MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2022-23898 Scanner template

    SQL injection in net.mingsoft:ms-mcms

    MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.

    net.mingsoft:ms-mcms Maven
  • Critical 9.1
    CVE-2021-46063

    Server Side Template Injection in MCMS

    MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2021-46036

    File upload leading to RCE in MCMS

    An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2021-44868 Scanner template

    SQL injection in MCMS

    A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2021-46386

    Mingsoft MCMS vulnerable to Remote Code Execution via file upload.

    File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2022-22930 EPSS 24%

    RCE in Mingsoft MCMS

    A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2022-23315

    Arbitrary file upload in Mingsoft MCMS

    MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2022-22929

    Arbitrary File Upload in Mingsoft MCMS

    MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2020-23262

    SQL injection without credentials in ming-soft MCMS

    An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.

    net.mingsoft:ms-mcms Maven
  • Critical 9.8
    CVE-2018-18830

    Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms

    An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code w…

    net.mingsoft:ms-mcms Maven