Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

net.mingsoft:ms-mcms

39 known vulnerabilities (4 critical, 4 high, 3 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
39 · 4 critical, 4 high, 3 medium, 3 low
Registry
Maven Central

Advisories 39

  • CVE-2026-2666Medium 5.1

    mingSoft MCMS Template Archive uploadTemplate.do unrestricted upload

    Affected: through 6.1.1.

  • CVE-2025-60837Medium 6.1

    A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a…

    Affected: through 6.0.1.

  • CVE-2025-56316Critical 9.8

    A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to…

    Affected: from 5.5.0, fixed in 6.0.2.

  • CVE-2025-29287Critical 9.8

    An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a…

    Affected: fixed in 5.4.4.

  • File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.

    Affected: through 5.3.5.

  • An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.

    Affected: through 5.2.4.

  • CVE-2023-50578Critical 9.8

    Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.

    Affected: through 5.2.9.

  • Mingsoft MCMS HTTP POST Request search.do cross site scripting

    Affected: fixed in 5.3.2.

  • File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail.

    Affected: through 5.0.0.

  • CVE-2020-20913Critical 9.8

    SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.

    Affected: fixed in 5.1.

  • MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.

    Affected: fixed in 5.2.11.

  • Mingsoft MCMS Article save cross site scripting

    Affected: through 5.2.9.

  • CVE-2022-4375Medium 6.3

    Mingsoft MCMS list sql injection

    Affected: fixed in 5.2.10.

  • Mingsoft MCMS search.do cross site scripting

    Affected: through 5.2.8.

  • Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.

    Affected: through 5.2.8.

Show all 39 advisoriesShow fewer advisories

  • Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.

    Affected: through 5.2.8.

  • MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.

    Affected: versions 5.2.8.

  • An issue was discovered in MCMS 5.2.7.

    Affected: through 5.2.7.

  • An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP…

    Affected: through 5.2.7.

  • MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do.

    Affected: through 5.2.7.

  • Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.

    Affected: through 5.2.7.

  • https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE.

    Affected: fixed in 5.2.6.

  • MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.

    Affected: through 5.2.5.

  • MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.

    Affected: through 5.2.5.

  • MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.

    Affected: through 5.2.5.

  • MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.

    Affected: fixed in 5.2.11.

  • MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.

    Affected: through 5.2.4.

  • An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary…

    Affected: through 5.2.4.

  • A problem was found in ming-soft MCMS v5.1.

    Affected: through 5.1.

  • https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection.

    Affected: through 5.2.5.

  • https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection.

    Affected: fixed in 5.2.6.

  • File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to…

    Affected: through 5.2.5.

  • A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code…

    Affected: fixed in 5.2.9.

  • MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.

    Affected: through 5.2.4.

  • MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute…

    Affected: through 5.2.4.

  • An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.

    Affected: fixed in 5.1.

  • An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5.

    Affected: through 4.6.5.

  • An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5.

    Affected: through 4.6.5.

  • An issue was discovered in MCMS 4.6.5.

    Affected: through 4.6.5.