VendorsMingsoftmcms5.2.4
Vulnerabilities

Mingsoft Mcms 5.2.4

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

9CVEs
CVE-2022-22930
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.
Published 2022-01-20 · Modified
9.8EPSS 0.237
CVE-2022-25125
MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.
Published 2022-03-03 · Modified
9.8EPSS 0.070
CVE-2021-46036
An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
Published 2022-02-18 · Modified
9.8EPSS 0.037
CVE-2022-22929
MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.
Published 2022-01-20 · Modified
9.8EPSS 0.026
CVE-2022-22928
MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code.
Published 2022-01-20 · Modified
9.8EPSS 0.025
CVE-2022-23315
MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.
Published 2022-01-20 · Modified
9.8EPSS 0.018
CVE-2022-23314
MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do.
Published 2022-01-20 · Modified
9.8EPSS 0.016
CVE-2021-46037
MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
Published 2022-02-18 · Modified
8.1EPSS 0.010
CVE-2023-51282
An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.
Published 2024-01-16 · Modified
7.5EPSS 0.011