ming-soft/MCMS

GitHub

github.com

www.mingsoft.net

Releases3

Frequency1 year 4 months

Last Release about 1 year ago

Stars1.58K

完整开源！Java快速开发平台！基于Spring、SpringMVC、Mybatis架构，MStore提供更多好用的插件与模板（文章、商城、微信、论坛、会员、评论、支付、积分、工作流、任务调度等，同时提供上百套免费模板任意选择），价值源自分享！铭飞系统不仅一套简单好用的开源系统、更是一整套优质的开源生态内容体系。铭飞的使命就是降低开发成本提高开发效率，提供全方位的企业级开发解决方案，每月28定期更新版本

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2025-56316 ↗	Oct 17, 2025Friday, 17 October 2025, 19:15	9.8 CRITICAL	—
A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.
CVE-2020-22755 ↗	May 8, 2023Monday, 8 May 2023, 14:15	8.8 HIGH	—
File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.
CVE-2020-20913 ↗	Apr 4, 2023Tuesday, 4 April 2023, 15:15	9.8 CRITICAL	—
SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.
CVE-2022-36272 ↗	Aug 16, 2022Tuesday, 16 August 2022, 13:15	9.8 CRITICAL	—
Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.
CVE-2022-31943 ↗	Jul 1, 2022Friday, 1 July 2022, 21:15	9.8 CRITICAL	7.5 HIGH
MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.
CVE-2022-27466 ↗	May 2, 2022Monday, 2 May 2022, 14:15	9.8 CRITICAL	7.5 HIGH
MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.
CVE-2022-27340 ↗	Apr 22, 2022Friday, 22 April 2022, 20:15	8.8 HIGH	6.8 MEDIUM
MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
CVE-2022-23898 ↗	Mar 3, 2022Thursday, 3 March 2022, 19:15	9.8 CRITICAL	7.5 HIGH
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
CVE-2022-23899 ↗	Mar 3, 2022Thursday, 3 March 2022, 19:15	9.8 CRITICAL	7.5 HIGH
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.
CVE-2021-46063 ↗	Feb 18, 2022Friday, 18 February 2022, 20:15	9.1 CRITICAL	6.4 MEDIUM
MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.
CVE-2021-46062 ↗	Feb 18, 2022Friday, 18 February 2022, 20:15	7.1 HIGH	5.8 MEDIUM
MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
CVE-2021-44868 ↗	Feb 17, 2022Thursday, 17 February 2022, 16:15	9.8 CRITICAL	7.5 HIGH
A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do
CVE-2020-23262 ↗	Jan 26, 2021Tuesday, 26 January 2021, 18:15	9.8 CRITICAL	7.5 HIGH
An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.