CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46062
https://notcve.org/view.php?id=CVE-2021-46062
18 Feb 2022 — MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName. Se ha detectado que MCMS versión v5.2.5, contiene una vulnerabilidad de eliminación arbitraria de archivos por medio del componente oldFileName • https://github.com/ming-soft/MCMS/issues/59 •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46037
https://notcve.org/view.php?id=CVE-2021-46037
18 Feb 2022 — MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do. Se ha detectado que MCMS versión v5.2.4, contiene una vulnerabilidad de eliminación arbitraria de archivos por medio del componente /template/unzip.do • https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2021-46036
https://notcve.org/view.php?id=CVE-2021-46036
18 Feb 2022 — An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code. Una vulnerabilidad de carga arbitraria de archivos en el componente /ms/file/uploadTemplate.do de MCMS versión v5.2.4, permite a atacantes ejecutar código arbitrario • https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-44868
https://notcve.org/view.php?id=CVE-2021-44868
17 Feb 2022 — A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do Se ha encontrado un problema en ming-soft MCMS versión v5.1. Se presenta una vulnerabilidad de inyección sql en el archivo /ms/cms/content/list.do • https://github.com/ming-soft/MCMS/issues/58 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46385
https://notcve.org/view.php?id=CVE-2021-46385
26 Jan 2022 — https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database. https://gitee.com/mingSoft/MCMS MCMS versiones anteriores a 5.2.5 incluyéndola, está afectado por: Inyección SQL. El impacto es: obtención de información confiden... • https://gitee.com/mingSoft/MCMS/issues/I4QZ1K • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46383
https://notcve.org/view.php?id=CVE-2021-46383
26 Jan 2022 — https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database. https://gitee.com/mingSoft/MCMS MCMS versiones anteriores a 5.2.5 incluyéndola, está afectado por: Inyección SQL. El impacto es: obtención de información confidencial ... • https://gitee.com/mingSoft/MCMS/issues/I4QZ1I • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46386
https://notcve.org/view.php?id=CVE-2021-46386
26 Jan 2022 — File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload. La vulnerabilidad en la carga de archivos en mingSoft MCMS a través de la versión 5.2.5, permite a los atacantes remotos ejecutar código arbitrario a través de un webshell jspx elaborado para net.mingsoft.basic.action.web.FileAction#upload • https://gitee.com/mingSoft/MCMS/issues/I4R0GW • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-22930
https://notcve.org/view.php?id=CVE-2022-22930
20 Jan 2022 — A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload. Una vulnerabilidad de ejecución de código remota (RCE) en la función Template Management de MCMS versión v5.2.4, permite a atacantes ejecutar código arbitrario por medio de una carga útil diseñada • https://gitee.com/mingSoft/MCMS/issues/I4Q4M6 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23314
https://notcve.org/view.php?id=CVE-2022-23314
20 Jan 2022 — MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. Se ha detectado que MCMS versión v5.2.4, contiene una vulnerabilidad de inyección SQL por medio del archivo /ms/mdiy/model/importJson.do • https://gitee.com/mingSoft/MCMS/issues/I4Q4OT • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23315
https://notcve.org/view.php?id=CVE-2022-23315
20 Jan 2022 — MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. Se ha detectado que MCMS versión v5.2.4, contiene una vulnerabilidad de carga de archivos arbitraria por medio del componente /ms/template/writeFileContent.do • https://gitee.com/mingSoft/MCMS/issues/I4Q4PX • CWE-434: Unrestricted Upload of File with Dangerous Type •