Mingsoft vulnerabilities
Published CVEs affecting Mingsoft products: 5 record(s), with severity, exploitation and fixes.
CVE-2026-4954
Medium · 6.3
CWE-74 Mar 27, 2026
mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection
A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-4953
High · 7.3
CWE-918 Mar 27, 2026
mingSoft MCMS Editor Endpoint BaseAction.java catchImage server-side request forgery
A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/BaseAction.java of the component Editor Endpoint. Executing a manipulation of the argument catchimage can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-2666
High · 7.2
CWE-284 Feb 18, 2026
mingSoft MCMS Template Archive uploadTemplate.do unrestricted upload
A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been published and may be used.
CVE-2025-60837
Medium · 6.1
CWE-79 Oct 23, 2025
Cross-site Scripting (XSS) in Mingsoft Mcms
A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
CVE-2025-56316
Critical · 9.8
CWE-89 Oct 17, 2025
SQL Injection in Mingsoft Mcms
A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.