Mingsoft vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-56316 A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL quCritical 9.8 · Oct 17, 2025
• CVE-2025-29287 An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.Critical 9.8 · Apr 21, 2025
• CVE-2024-42991 MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.High 8.1 · Sep 3, 2024
• CVE-2024-22567 File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.High 8.8 · Feb 5, 2024
• CVE-2023-51282 An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.High 7.5 · Jan 15, 2024
• CVE-2023-50578 Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.Critical 9.8 · Dec 30, 2023
• CVE-2020-22755 File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail.High 8.8 · May 8, 2023
• CVE-2020-20913 SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.Critical 9.8 · Apr 4, 2023
• CVE-2022-47042 MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.High 8.8 · Jan 26, 2023
• CVE-2022-36599 Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.Critical 9.8 · Aug 16, 2022
• CVE-2022-36272 Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.Critical 9.8 · Aug 16, 2022
• CVE-2022-31943 MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.Critical 9.8 · Jul 1, 2022
• CVE-2022-30506 An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.Critical 9.8 · Jun 2, 2022
• CVE-2022-29647 An issue was discovered in MCMS 5.2.7.High 8.8 · Jun 2, 2022
• CVE-2022-30048 Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter.Critical 9.8 · May 11, 2022
• CVE-2022-30047 Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter.Critical 9.8 · May 11, 2022
• CVE-2022-27466 MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.Critical 9.8 · May 2, 2022
• CVE-2022-27340 MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do.High 8.8 · Apr 22, 2022
• CVE-2022-26585 Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.Critical 9.8 · Apr 4, 2022
• CVE-2021-46384 https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE.Critical 9.8 · Mar 4, 2022
• CVE-2022-25125 MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.Critical 9.8 · Mar 3, 2022
• CVE-2022-23899 MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.Critical 9.8 · Mar 3, 2022
• CVE-2022-23898 MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.Critical 9.8 · Mar 3, 2022
• CVE-2021-46063 MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.Critical 9.1 · Feb 18, 2022
• CVE-2021-46062 MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.High 7.1 · Feb 18, 2022