Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
11 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A SQL injection vulnerability in the contenttitle parameter of the /cms/content/list endpoint in MCMS 5.5.0 through 6.0.1 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.
Recommended action: Upgrade to 6.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
Recommended action: Upgrade to 5.4.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Cross-site Scripting vulnerability has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
Recommended action: Upgrade to 5.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basictitle parameter. This issue is resolved in v5.1.
Recommended action: Upgrade to 5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
Recommended action: Upgrade to 5.2.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.
Recommended action: Upgrade to 5.2.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
net.mingsoft:ms-mcms <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS.
Recommended action: Upgrade to 5.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
net.mingsoft:ms-basic is used for plugin management for applications built with Maven for the Mingfei Content Management System (MCMS). ms-basic before 2.1.16 is vulnerable to arbitrary file deletion using POST requests to /template/writeFileContent via the oldFileName parameter. MCMS before 5.2.11 is also vulnerable since it bundles vulnerable versions of ms-basic.
Recommended action: Upgrade to 5.2.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.
Recommended action: Upgrade to 5.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Mingsoft MCMS contains a SQL injection vulnerability relating to the component net.mingsoft.mdiy.action.web.DictAction#list.
Recommended action: Upgrade to 5.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution (RCE) vulnerability in the Template Management function of MCMS allows attackers to execute arbitrary code via a crafted payload.
Recommended action: Upgrade to 5.2.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.