# net.mingsoft:ms-mcms (Maven) vulnerabilities

39 known vulnerabilities (4 critical, 4 high, 3 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/net.mingsoft/ms-mcms

## Advisories (39)

### [CVE-2026-2666](https://cve.now/CVE-2026-2666): mingSoft MCMS Template Archive uploadTemplate.do unrestricted upload

- Severity: Medium 5.1
- Published: Feb 18, 2026
- Affected: through 6.1.1.

### [CVE-2025-60837](https://cve.now/CVE-2025-60837): A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a…

- Severity: Medium 6.1
- Published: Oct 23, 2025
- Affected: through 6.0.1.

### [CVE-2025-56316](https://cve.now/CVE-2025-56316): A SQL injection vulnerability in the content\_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to…

- Severity: Critical 9.8
- Published: Oct 17, 2025
- Affected: from 5.5.0, fixed in 6.0.2.

### [CVE-2025-29287](https://cve.now/CVE-2025-29287): An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a…

- Severity: Critical 9.8
- Published: Apr 21, 2025
- Affected: fixed in 5.4.4.

### [CVE-2024-22567](https://cve.now/CVE-2024-22567): File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.

- Severity: High 8.8
- Published: Feb 5, 2024
- Affected: through 5.3.5.

### [CVE-2023-51282](https://cve.now/CVE-2023-51282): An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.

- Severity: High 7.5
- Published: Jan 16, 2024
- Affected: through 5.2.4.

### [CVE-2023-50578](https://cve.now/CVE-2023-50578): Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.

- Severity: Critical 9.8
- Published: Dec 30, 2023
- Affected: through 5.2.9.

### [CVE-2023-3990](https://cve.now/CVE-2023-3990): Mingsoft MCMS HTTP POST Request search.do cross site scripting

- Severity: Low 3.5
- Published: Jul 28, 2023
- Affected: fixed in 5.3.2.

### [CVE-2020-22755](https://cve.now/CVE-2020-22755): File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail.

- Severity: High 8.8
- Published: May 8, 2023
- Affected: through 5.0.0.

### [CVE-2020-20913](https://cve.now/CVE-2020-20913): SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic\_title parameter.

- Severity: Critical 9.8
- Published: Apr 4, 2023
- Affected: fixed in 5.1.

### [CVE-2022-47042](https://cve.now/CVE-2022-47042): MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.

- Severity: High 8.8
- Published: Jan 24, 2023
- Affected: fixed in 5.2.11.

### [CVE-2022-4640](https://cve.now/CVE-2022-4640): Mingsoft MCMS Article save cross site scripting

- Severity: Low 3.5
- Published: Dec 21, 2022
- Affected: through 5.2.9.

### [CVE-2022-4375](https://cve.now/CVE-2022-4375): Mingsoft MCMS list sql injection

- Severity: Medium 6.3
- Published: Dec 9, 2022
- Affected: fixed in 5.2.10.

### [CVE-2022-4350](https://cve.now/CVE-2022-4350): Mingsoft MCMS search.do cross site scripting

- Severity: Low 3.5
- Published: Dec 8, 2022
- Affected: through 5.2.8.

### [CVE-2022-36599](https://cve.now/CVE-2022-36599): Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.

- Severity: Unrated
- Published: Aug 16, 2022
- Affected: through 5.2.8.

### [CVE-2022-36272](https://cve.now/CVE-2022-36272): Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.

- Severity: Unrated
- Published: Aug 16, 2022
- Affected: through 5.2.8.

### [CVE-2022-31943](https://cve.now/CVE-2022-31943): MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.

- Severity: Unrated
- Published: Jul 1, 2022
- Affected: versions 5.2.8.

### [CVE-2022-29647](https://cve.now/CVE-2022-29647): An issue was discovered in MCMS 5.2.7.

- Severity: Unrated
- Published: May 31, 2022
- Affected: through 5.2.7.

### [CVE-2022-30506](https://cve.now/CVE-2022-30506): An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP…

- Severity: Unrated
- Published: May 27, 2022
- Affected: through 5.2.7.

### [CVE-2022-27340](https://cve.now/CVE-2022-27340): MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do.

- Severity: Unrated
- Published: Apr 22, 2022
- Affected: through 5.2.7.

### [CVE-2022-26585](https://cve.now/CVE-2022-26585): Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.

- Severity: Unrated
- Published: Apr 5, 2022
- Affected: through 5.2.7.

### [CVE-2021-46384](https://cve.now/CVE-2021-46384): https://gitee.com/mingSoft/MCMS MCMS \<=5.2.5 is affected by: RCE.

- Severity: Unrated
- Published: Mar 4, 2022
- Affected: fixed in 5.2.6.

### [CVE-2022-23899](https://cve.now/CVE-2022-23899): MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.

- Severity: Unrated
- Published: Mar 3, 2022
- Affected: through 5.2.5.

### [CVE-2022-23898](https://cve.now/CVE-2022-23898): MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.

- Severity: Unrated
- Published: Mar 3, 2022
- Affected: through 5.2.5.

### [CVE-2021-46063](https://cve.now/CVE-2021-46063): MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.

- Severity: Unrated
- Published: Feb 18, 2022
- Affected: through 5.2.5.

### [CVE-2021-46062](https://cve.now/CVE-2021-46062): MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.

- Severity: Unrated
- Published: Feb 18, 2022
- Affected: fixed in 5.2.11.

### [CVE-2021-46037](https://cve.now/CVE-2021-46037): MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.

- Severity: Unrated
- Published: Feb 18, 2022
- Affected: through 5.2.4.

### [CVE-2021-46036](https://cve.now/CVE-2021-46036): An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary…

- Severity: Unrated
- Published: Feb 18, 2022
- Affected: through 5.2.4.

### [CVE-2021-44868](https://cve.now/CVE-2021-44868): A problem was found in ming-soft MCMS v5.1.

- Severity: Unrated
- Published: Feb 17, 2022
- Affected: through 5.1.

### [CVE-2021-46385](https://cve.now/CVE-2021-46385): https://gitee.com/mingSoft/MCMS MCMS \<=5.2.5 is affected by: SQL Injection.

- Severity: Unrated
- Published: Jan 26, 2022
- Affected: through 5.2.5.

### [CVE-2021-46383](https://cve.now/CVE-2021-46383): https://gitee.com/mingSoft/MCMS MCMS \<=5.2.5 is affected by: SQL Injection.

- Severity: Unrated
- Published: Jan 26, 2022
- Affected: fixed in 5.2.6.

### [CVE-2021-46386](https://cve.now/CVE-2021-46386): File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to…

- Severity: Unrated
- Published: Jan 26, 2022
- Affected: through 5.2.5.

### [CVE-2022-22930](https://cve.now/CVE-2022-22930): A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code…

- Severity: Unrated
- Published: Jan 20, 2022
- Affected: fixed in 5.2.9.

### [CVE-2022-23315](https://cve.now/CVE-2022-23315): MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.

- Severity: Unrated
- Published: Jan 20, 2022
- Affected: through 5.2.4.

### [CVE-2022-22929](https://cve.now/CVE-2022-22929): MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute…

- Severity: Unrated
- Published: Jan 20, 2022
- Affected: through 5.2.4.

### [CVE-2020-23262](https://cve.now/CVE-2020-23262): An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.

- Severity: Unrated
- Published: Jan 22, 2021
- Affected: fixed in 5.1.

### [CVE-2018-18831](https://cve.now/CVE-2018-18831): An issue was discovered in com\\mingsoft\\cms\\action\\GeneraterAction.java in MCMS 4.6.5.

- Severity: Unrated
- Published: Oct 30, 2018
- Affected: through 4.6.5.

### [CVE-2018-18830](https://cve.now/CVE-2018-18830): An issue was discovered in com\\mingsoft\\basic\\action\\web\\FileAction.java in MCMS 4.6.5.

- Severity: Unrated
- Published: Oct 30, 2018
- Affected: through 4.6.5.

### [CVE-2018-17366](https://cve.now/CVE-2018-17366): An issue was discovered in MCMS 4.6.5.

- Severity: Unrated
- Published: Sep 23, 2018
- Affected: through 4.6.5.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/net.mingsoft:ms-mcms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.