CVE-2026-31272 | Critical | 9.8 | 2026-04-07 | MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper author… |
CVE-2026-29909 | Medium | 5.3 | 2026-03-30 | MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authenticati… |
CVE-2025-50581 | Medium | 4.8 | 2025-07-18 | MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do. |
CVE-2025-4327 | Medium | 4.3 | 2025-05-06 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request… |
CVE-2025-4326 | Low | 2.4 | 2025-05-06 | A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects some unknown processing of the file /admin/chip/add.do of the compon… |
CVE-2025-4325 | Low | 2.4 | 2025-05-06 | A vulnerability has been found in MRCMS 3.1.2 and classified as problematic. This vulnerability affects unknown code of the file /admin/category/add.do of the… |
CVE-2025-4324 | Low | 2.4 | 2025-05-06 | A vulnerability, which was classified as problematic, was found in MRCMS 3.1.2. This affects an unknown part of the file /admin/link/edit.do of the component E… |
CVE-2025-4323 | Low | 2.4 | 2025-05-06 | A vulnerability, which was classified as problematic, has been found in MRCMS 3.1.2. Affected by this issue is some unknown functionality of the component Edit… |
CVE-2025-4293 | Low | 2.4 | 2025-05-05 | A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/group/edit.do o… |
CVE-2025-4292 | Low | 2.4 | 2025-05-05 | A vulnerability has been found in MRCMS 3.1.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/user… |
CVE-2025-2196 | Low | 3.5 | 2025-03-11 | A vulnerability was found in MRCMS 3.1.2. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /admin/file/up… |
CVE-2025-2195 | Low | 3.5 | 2025-03-11 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is the function rename of the file /admin/file/rename.do of the compo… |
CVE-2025-2194 | Low | 3.5 | 2025-03-11 | A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects the function list of the file /admin/file/list.do of the component o… |
CVE-2025-2193 | Medium | 5.4 | 2025-03-11 | A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of t… |
CVE-2025-25768 | Medium | 5.4 | 2025-02-21 | MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerabili… |
CVE-2025-25767 | Medium | 4.8 | 2025-02-21 | A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via… |
CVE-2025-25766 | Medium | 4.8 | 2025-02-21 | An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .j… |
CVE-2025-25765 | Medium | 4.0 | 2025-02-21 | MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do. |
CVE-2024-48177 | High | 8.8 | 2024-10-28 | MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do. |
CVE-2024-25428 | Medium | 6.5 | 2024-02-20 | SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter. |
CVE-2024-24161 | High | 7.5 | 2024-02-02 | MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered. |
CVE-2024-24160 | Medium | 5.4 | 2024-02-02 | MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do. |