MCMS vulnerable SQL injection via the content_title parameter

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-56316 · ADVISORY
• ming-soft/MCMS commit 35ccbf1 · WEB
• gist.github.com/Erosion2020/5892757e0c6eeb647a218d1c3b323cff · WEB
• ming-soft/MCMS · PACKAGE

Mais vulnerabilidades de net.mingsoft:ms-mcms

• CVE-2026-2666ALTO 7.2A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the comp…
• CVE-2025-60837MÉDIO 6.1A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a use…
• CVE-2025-29287CRÍTICO 9.8An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a cr…
• CVE-2024-22567ALTO 8.8File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.
• CVE-2023-51282ALTO 7.5An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.