CVE-2026-19357 | Medium | 5.3 | 2026-08-09 | A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The mani… |
CVE-2026-19356 | Medium | 5.3 | 2026-08-09 | A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The ma… |
CVE-2026-19355 | High | 7.3 | 2026-08-09 | A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of th… |
CVE-2026-4954 | Medium | 6.3 | 2026-03-27 | A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.ja… |
CVE-2026-4953 | High | 7.3 | 2026-03-27 | A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/BaseAction.java of… |
CVE-2026-2666 | Medium | 4.7 | 2026-02-18 | A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Arch… |
CVE-2025-60837 | Medium | 6.1 | 2025-10-23 | A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a c… |
CVE-2025-56316 | Critical | 9.8 | 2025-10-17 | A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL q… |
CVE-2025-60838 | Medium | 6.5 | 2025-10-10 | An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2025-29287 | Critical | 9.8 | 2025-04-21 | An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-42991 | High | 8.1 | 2024-09-03 | MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution. |
CVE-2024-22567 | High | 8.8 | 2024-02-05 | File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do. |
CVE-2023-51282 | High | 7.5 | 2024-01-16 | An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter. |
CVE-2023-50578 | Critical | 9.8 | 2023-12-30 | Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do. |
CVE-2023-3990 | Low | 3.5 | 2023-07-28 | A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP… |
CVE-2020-22755 | High | 8.8 | 2023-05-08 | File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943. |
CVE-2020-20913 | Critical | 9.8 | 2023-04-04 | SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter. |
CVE-2022-47042 | High | 8.8 | 2023-01-26 | MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do. |
CVE-2022-4640 | Low | 3.5 | 2022-12-21 | A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Artic… |
CVE-2022-4375 | Medium | 6.3 | 2022-12-09 | A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The… |
CVE-2022-4350 | Low | 3.5 | 2022-12-08 | A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8. Affected is an unknown function of the file search.do. The manipulation… |
CVE-2022-36599 | Critical | 9.8 | 2022-08-16 | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists. |
CVE-2022-36272 | Critical | 9.8 | 2022-08-16 | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter. |
CVE-2022-31943 | Critical | 9.8 | 2022-07-01 | MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2022-30506 | Critical | 9.8 | 2022-06-02 | An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file. |
CVE-2022-29647 | High | 8.8 | 2022-06-02 | An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. |
CVE-2022-30048 | Critical | 9.8 | 2022-05-11 | Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter. |
CVE-2022-30047 | Critical | 9.8 | 2022-05-11 | Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter. |
CVE-2022-27466 | Critical | 9.8 | 2022-05-02 | MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do. |
CVE-2022-27340 | High | 8.8 | 2022-04-22 | MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify d… |
CVE-2022-26585 | Critical | 9.8 | 2022-04-05 | Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list. |
CVE-2021-46384 | Critical | 9.8 | 2022-03-04 | https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template… |
CVE-2022-25125 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. |
CVE-2022-23899 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java. |
CVE-2022-23898 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. |
CVE-2021-46063 | Critical | 9.1 | 2022-02-18 | MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module. |
CVE-2021-46062 | High | 7.1 | 2022-02-18 | MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName. |
CVE-2021-46037 | High | 8.1 | 2022-02-18 | MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do. |
CVE-2021-46036 | Critical | 9.8 | 2022-02-18 | An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code. |
CVE-2021-44868 | Critical | 9.8 | 2022-02-17 | A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do |
CVE-2021-46385 | High | 7.5 | 2022-01-26 | https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsof… |
CVE-2021-46386 | Critical | 9.8 | 2022-01-26 | File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.a… |
CVE-2021-46383 | High | 7.5 | 2022-01-26 | https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsof… |
CVE-2022-23315 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. |
CVE-2022-23314 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do. |
CVE-2022-22930 | Critical | 9.8 | 2022-01-21 | A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload. |
CVE-2022-22929 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a cr… |
CVE-2022-22928 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code. |
CVE-2020-23262 | Critical | 9.8 | 2021-01-26 | An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do. |
CVE-2018-18831 | High | 7.5 | 2018-10-30 | An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbi… |
CVE-2018-18830 | Critical | 9.8 | 2018-10-30 | An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you c… |
CVE-2018-17366 | High | 8.8 | 2018-09-23 | An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. |