CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46383
https://notcve.org/view.php?id=CVE-2021-46383
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database. https://gitee.com/mingSoft/MCMS MCMS versiones anteriores a 5.2.5 incluyéndola, está afectado por: Inyección SQL. El impacto es: obtención de información confidencial (remota). • https://gitee.com/mingSoft/MCMS/issues/I4QZ1I • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2021-46386
https://notcve.org/view.php?id=CVE-2021-46386
File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload. La vulnerabilidad en la carga de archivos en mingSoft MCMS a través de la versión 5.2.5, permite a los atacantes remotos ejecutar código arbitrario a través de un webshell jspx elaborado para net.mingsoft.basic.action.web.FileAction#upload • https://gitee.com/mingSoft/MCMS/issues/I4R0GW • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2022-22930
https://notcve.org/view.php?id=CVE-2022-22930
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload. Una vulnerabilidad de ejecución de código remota (RCE) en la función Template Management de MCMS versión v5.2.4, permite a atacantes ejecutar código arbitrario por medio de una carga útil diseñada • https://gitee.com/mingSoft/MCMS/issues/I4Q4M6 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23315
https://notcve.org/view.php?id=CVE-2022-23315
MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. Se ha detectado que MCMS versión v5.2.4, contiene una vulnerabilidad de carga de archivos arbitraria por medio del componente /ms/template/writeFileContent.do • https://gitee.com/mingSoft/MCMS/issues/I4Q4PX • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23314
https://notcve.org/view.php?id=CVE-2022-23314
MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. Se ha detectado que MCMS versión v5.2.4, contiene una vulnerabilidad de inyección SQL por medio del archivo /ms/mdiy/model/importJson.do • https://gitee.com/mingSoft/MCMS/issues/I4Q4OT • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •