Skip to content
Noroxi

MingSoft records

48 published records for vendor mingsoft.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
16
With a fix record
22.9%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 21
  3. 22
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

48 records
  • CVE-2022-22930
    46Plan

    A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code vi

    CriticalCVSS 9.8No exploitEPSS 24%

    mingsoft · mcmsJan 20, 2022

  • CVE-2022-23898
    41Plan

    MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.

    CriticalCVSS 9.8Proof of conceptEPSS 8%

    mingsoft · mcmsMar 3, 2022

  • CVE-2022-25125
    41Plan

    MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.

    CriticalCVSS 9.8Proof of conceptEPSS 7%

    mingsoft · mcmsMar 3, 2022

  • CVE-2022-26585
    41Plan

    Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    mingsoft · mcmsApr 4, 2022

  • CVE-2024-22567
    40Plan

    File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.

    HighCVSS 8.8No exploitEPSS 18%

    mingsoft · mcmsFeb 5, 2024

  • CVE-2021-46036
    40Plan

    An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code

    CriticalCVSS 9.8No exploitEPSS 4%

    mingsoft · mcmsFeb 18, 2022

  • CVE-2021-46386
    40Plan

    File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to n

    CriticalCVSS 9.8No exploitEPSS 3%

    mingsoft · mcmsJan 26, 2022

  • CVE-2022-4375
    40Plan

    Mingsoft MCMS list sql injection

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    mingsoft · mcmsDec 9, 2022

  • CVE-2022-22929
    40Plan

    MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbi

    CriticalCVSS 9.8No exploitEPSS 3%

    mingsoft · mcmsJan 20, 2022

  • CVE-2022-30506
    40Plan

    An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP fi

    CriticalCVSS 9.8No exploitEPSS 3%

    mingsoft · mcmsJun 2, 2022

  • CVE-2022-22928
    40Plan

    MCMS v5.2.4 was discovered to have a hardcoded shiro-key, allowing attackers to exploit the key and execute arbitrary code.

    CriticalCVSS 9.8No exploitEPSS 3%

    mingsoft · mcmsJan 20, 2022

  • CVE-2023-50578
    40Plan

    Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    mingsoft · mcmsDec 30, 2023

  • CVE-2021-46384
    40Plan

    https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE.

    CriticalCVSS 9.8No exploitEPSS 2%

    mingsoft · mcmsMar 4, 2022

  • CVE-2022-23315
    40Plan

    MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.

    CriticalCVSS 9.8No exploitEPSS 2%

    mingsoft · mcmsJan 20, 2022

  • CVE-2022-27466
    39Monitor

    MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.

    CriticalCVSS 9.8No exploitEPSS 2%

    mingsoft · mcmsMay 2, 2022

  • CVE-2022-23314
    39Monitor

    MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via /ms/mdiy/model/importJson.do.

    CriticalCVSS 9.8No exploitEPSS 2%

    mingsoft · mcmsJan 20, 2022

  • CVE-2022-31943
    39Monitor

    MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.

    CriticalCVSS 9.8No exploitEPSS 2%

    mingsoft · mcmsJul 1, 2022

  • CVE-2022-30047
    39Monitor

    Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/listExcludeApp URI via orderBy parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    mingsoft · mcmsMay 11, 2022

  • CVE-2022-30048
    39Monitor

    Mingsoft MCMS 5.2.7 was discovered to contain a SQL injection vulnerability in /mdiy/dict/list URI via orderBy parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    mingsoft · mcmsMay 11, 2022

  • CVE-2020-20913
    39Monitor

    SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    mingsoft · mcmsApr 4, 2023

  • CVE-2021-44868
    39Monitor

    A problem was found in ming-soft MCMS v5.1.

    CriticalCVSS 9.8No exploitEPSS 1%

    mingsoft · mcmsFeb 17, 2022

  • CVE-2018-18830
    39Monitor

    An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5.

    CriticalCVSS 9.8No exploitEPSS 1%

    mingsoft · mcmsOct 30, 2018

  • CVE-2020-23262
    39Monitor

    An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do.

    CriticalCVSS 9.8No exploitEPSS 1%

    mingsoft · mcmsJan 26, 2021

  • CVE-2022-36272
    39Monitor

    Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/page/verify URI via fieldName parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    mingsoft · mcmsAug 16, 2022

  • CVE-2022-36599
    39Monitor

    Mingsoft MCMS 5.2.8 was discovered to contain a SQL injection vulnerability in /mdiy/model/delete URI via models Lists.

    CriticalCVSS 9.8No exploitEPSS 1%

    mingsoft · mcmsAug 16, 2022