CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-51282
https://notcve.org/view.php?id=CVE-2023-51282
16 Jan 2024 — An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter. Un problema en mingSoft MCMS v.5.2.4 permite a un atacante remoto obtener información confidencial a través de un script manipulado para el parámetro de password. • https://gitee.com/mingSoft/MCMS/issues/I4Q4NV • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-3990 – Mingsoft MCMS HTTP POST Request search.do cross site scripting
https://notcve.org/view.php?id=CVE-2023-3990
28 Jul 2023 — A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://gitee.com/mingSoft/MCMS/issues/I7K4DQ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 22%CPEs: 1EXPL: 2CVE-2022-4375 – Mingsoft MCMS list sql injection
https://notcve.org/view.php?id=CVE-2022-4375
09 Dec 2022 — A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. • https://gitee.com/mingSoft/MCMS/issues/I61TG5 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE-707: Improper Neutralization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46384
https://notcve.org/view.php?id=CVE-2021-46384
04 Mar 2022 — https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS. https://gitee.com/mingSoft/MCMS MCMS versiones anteriores a 5.2.5 incluyéndola, está afectado por: RCE. • https://gitee.com/mingSoft/MCMS/issues/I4QZ1O • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 1CVE-2022-25125
https://notcve.org/view.php?id=CVE-2022-25125
03 Mar 2022 — MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. Se ha detectado que MCMS versión v5.2.4, contiene una vulnerabilidad de inyección SQL por medio de search.do en el archivo /mdiy/dict/listExcludeApp • https://gitee.com/mingSoft/MCMS/issues/I4TGYI • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46037
https://notcve.org/view.php?id=CVE-2021-46037
18 Feb 2022 — MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do. Se ha detectado que MCMS versión v5.2.4, contiene una vulnerabilidad de eliminación arbitraria de archivos por medio del componente /template/unzip.do • https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2021-46036
https://notcve.org/view.php?id=CVE-2021-46036
18 Feb 2022 — An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code. Una vulnerabilidad de carga arbitraria de archivos en el componente /ms/file/uploadTemplate.do de MCMS versión v5.2.4, permite a atacantes ejecutar código arbitrario • https://lycshub.github.io/2021/12/28/MCMS-vulnerabilities • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46385
https://notcve.org/view.php?id=CVE-2021-46385
26 Jan 2022 — https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database. https://gitee.com/mingSoft/MCMS MCMS versiones anteriores a 5.2.5 incluyéndola, está afectado por: Inyección SQL. El impacto es: obtención de información confiden... • https://gitee.com/mingSoft/MCMS/issues/I4QZ1K • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46383
https://notcve.org/view.php?id=CVE-2021-46383
26 Jan 2022 — https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database. https://gitee.com/mingSoft/MCMS MCMS versiones anteriores a 5.2.5 incluyéndola, está afectado por: Inyección SQL. El impacto es: obtención de información confidencial ... • https://gitee.com/mingSoft/MCMS/issues/I4QZ1I • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46386
https://notcve.org/view.php?id=CVE-2021-46386
26 Jan 2022 — File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload. La vulnerabilidad en la carga de archivos en mingSoft MCMS a través de la versión 5.2.5, permite a los atacantes remotos ejecutar código arbitrario a través de un webshell jspx elaborado para net.mingsoft.basic.action.web.FileAction#upload • https://gitee.com/mingSoft/MCMS/issues/I4R0GW • CWE-434: Unrestricted Upload of File with Dangerous Type •