CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 1CVE-2022-47042
https://notcve.org/view.php?id=CVE-2022-47042
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do. Se descubrió que MCMS v5.2.10 y versiones anteriores contenían una vulnerabilidad de escritura de archivos arbitraria a través del componente ms/template/writeFileContent.do. • https://gitee.com/mingSoft/MCMS/issues/I6592F • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4640 – Mingsoft MCMS Article save cross site scripting
https://notcve.org/view.php?id=CVE-2022-4640
A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Article Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://gitee.com/mingSoft/MCMS/issues/I65KI5 https://vuldb.com/?id.216499 • CWE-707: Improper Neutralization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-4375 – Mingsoft MCMS list sql injection
https://notcve.org/view.php?id=CVE-2022-4375
A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. • https://gitee.com/mingSoft/MCMS/issues/I61TG5 https://vuldb.com/?id.215196 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-707: Improper Neutralization •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2022-4350 – Mingsoft MCMS search.do cross site scripting
https://notcve.org/view.php?id=CVE-2022-4350
A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8. Affected is an unknown function of the file search.do. The manipulation of the argument content_title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://gitee.com/mingSoft/MCMS/issues/I5MT8Y https://vuldb.com/?id.215112 • CWE-707: Improper Neutralization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-36599
https://notcve.org/view.php?id=CVE-2022-36599
Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists. Se ha detectado que Mingsoft MCMS versión 5.2.8, contiene una vulnerabilidad de inyección SQL en /mdiy/model/delete URI por medio de models Lists. • https://gitee.com/mingSoft/MCMS/issues/I5I1P5 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •