Mingsoft Mcms
52 CVEs affecting Mingsoft Mcms. Latest disclosed: 2026-08-09. Critical: 27, High: 15.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-56316 | Critical | 9.8 | 2025-10-17 | A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL q… |
CVE-2025-29287 | Critical | 9.8 | 2025-04-21 | An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2023-50578 | Critical | 9.8 | 2023-12-30 | Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do. |
CVE-2020-20913 | Critical | 9.8 | 2023-04-04 | SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter. |
CVE-2022-36599 | Critical | 9.8 | 2022-08-16 | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists. |
CVE-2022-36272 | Critical | 9.8 | 2022-08-16 | Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter. |
CVE-2022-31943 | Critical | 9.8 | 2022-07-01 | MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2022-30506 | Critical | 9.8 | 2022-06-02 | An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file. |
CVE-2022-30048 | Critical | 9.8 | 2022-05-11 | Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter. |
CVE-2022-30047 | Critical | 9.8 | 2022-05-11 | Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter. |
CVE-2022-27466 | Critical | 9.8 | 2022-05-02 | MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do. |
CVE-2022-26585 | Critical | 9.8 | 2022-04-05 | Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list. |
CVE-2021-46384 | Critical | 9.8 | 2022-03-04 | https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template… |
CVE-2022-25125 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. |
CVE-2022-23899 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java. |
CVE-2022-23898 | Critical | 9.8 | 2022-03-03 | MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. |
CVE-2021-46036 | Critical | 9.8 | 2022-02-18 | An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code. |
CVE-2021-44868 | Critical | 9.8 | 2022-02-17 | A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do |
CVE-2021-46386 | Critical | 9.8 | 2022-01-26 | File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.a… |
CVE-2022-23315 | Critical | 9.8 | 2022-01-21 | MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do. |