Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Mingsoft Subscribe
Filtered by product Mcms
Total 34 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-46036 1 Mingsoft 1 Mcms 2022-02-25 7.5 HIGH 9.8 CRITICAL
An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
CVE-2021-46037 1 Mingsoft 1 Mcms 2022-02-25 5.5 MEDIUM 8.1 HIGH
MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
CVE-2021-46062 1 Mingsoft 1 Mcms 2022-02-25 5.8 MEDIUM 7.1 HIGH
MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
CVE-2021-44868 1 Mingsoft 1 Mcms 2022-02-24 7.5 HIGH 9.8 CRITICAL
A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do
CVE-2021-46385 1 Mingsoft 1 Mcms 2022-02-04 5.0 MEDIUM 7.5 HIGH
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.FormDataAction#queryData. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.
CVE-2021-46383 1 Mingsoft 1 Mcms 2022-02-02 5.0 MEDIUM 7.5 HIGH
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.
CVE-2022-23315 1 Mingsoft 1 Mcms 2022-01-26 7.5 HIGH 9.8 CRITICAL
MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.
CVE-2022-23314 1 Mingsoft 1 Mcms 2022-01-26 7.5 HIGH 9.8 CRITICAL
MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do.
CVE-2022-22930 1 Mingsoft 1 Mcms 2022-01-26 7.5 HIGH 9.8 CRITICAL
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.
CVE-2022-22929 1 Mingsoft 1 Mcms 2022-01-26 7.5 HIGH 9.8 CRITICAL
MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.
CVE-2022-22928 1 Mingsoft 1 Mcms 2022-01-26 7.5 HIGH 9.8 CRITICAL
MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code.
CVE-2020-23262 1 Mingsoft 1 Mcms 2021-01-29 7.5 HIGH 9.8 CRITICAL
An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.
CVE-2018-18830 1 Mingsoft 1 Mcms 2018-12-11 7.5 HIGH 9.8 CRITICAL
An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.
CVE-2018-18831 1 Mingsoft 1 Mcms 2018-12-11 5.0 MEDIUM 7.5 HIGH
An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via a ../ Directory Traversal in the url parameter.