mrcms records

22 published records for vendor mrcms.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 2
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

22 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-31272No exploit	MRCMS 3.1.2 contains an access control vulnerability.mrcms · mrcms · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.8	—	0.6%	Apr 7, 2026
35Monitor	CVE-2024-48177No exploit	MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do.mrcms · mrcms · CWE-89 SQL injection	High8.8	—	0.4%	Oct 28, 2024
30Monitor	CVE-2024-24161No exploit	MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered.mrcms · mrcms · CWE-552 Pre-auth	High7.5	—	0.7%	Feb 2, 2024
26Monitor	CVE-2024-25428No exploit	SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter.mrcms · mrcms · CWE-89 Pre-auth SQL injection	Medium6.5	—	0.4%	Feb 20, 2024
21Monitor	CVE-2025-2193No exploit	MRCMS org.marker.mushroom.controller.FileController delete.do delete path traversalmrcms · mrcms · CWE-22 Path traversal	Medium5.3	—	0.8%	Mar 11, 2025
21Monitor	CVE-2026-29909Proof of concept	MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module.mrcms · mrcms · CWE-20 Pre-auth	Medium5.3	—	0.5%	Mar 30, 2026
21Monitor	CVE-2024-24160No exploit	MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do.mrcms · mrcms · CWE-79 XSS	Medium5.4	—	0.4%	Feb 2, 2024
21Monitor	CVE-2025-25768No exploit	MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.javmrcms · mrcms · CWE-77 pre-auth RCE Command injection SSTI	Medium5.4	—	0.3%	Feb 21, 2025
21Monitor	CVE-2025-4327No exploit	MRCMS cross-site request forgerymrcms · mrcms · CWE-352 Pre-auth CSRF	Medium5.3	—	0.3%	May 6, 2025
20Monitor	CVE-2025-2196No exploit	MRCMS org.marker.mushroom.controller.FileController upload.do upload cross site scriptingmrcms · mrcms · CWE-79 XSS	Medium5.1	—	0.4%	Mar 11, 2025
20Monitor	CVE-2025-2194No exploit	MRCMS org.marker.mushroom.controller.FileController list.do list cross site scriptingmrcms · mrcms · CWE-79 XSS	Medium5.1	—	0.4%	Mar 11, 2025
20Monitor	CVE-2025-2195No exploit	MRCMS org.marker.mushroom.controller.FileController rename.do rename cross site scriptingmrcms · mrcms · CWE-79 XSS	Medium5.1	—	0.4%	Mar 11, 2025
19Monitor	CVE-2025-4325No exploit	MRCMS Category Management Page add.do cross site scriptingmrcms · mrcms · CWE-79 XSS	Medium4.8	—	0.4%	May 6, 2025
19Monitor	CVE-2025-4293No exploit	MRCMS Group Edit Page edit.do cross site scriptingmrcms · mrcms · CWE-79 XSS	Medium4.8	—	0.3%	May 5, 2025
19Monitor	CVE-2025-4323No exploit	MRCMS Edit Article Page cross site scriptingmrcms · mrcms · CWE-79 XSS	Medium4.8	—	0.3%	May 6, 2025
19Monitor	CVE-2025-4324No exploit	MRCMS External Link Management Page edit.do cross site scriptingmrcms · mrcms · CWE-79 XSS	Medium4.8	—	0.3%	May 6, 2025
19Monitor	CVE-2025-4326No exploit	MRCMS Add Fragment Page add.do cross site scriptingmrcms · mrcms · CWE-79 XSS	Medium4.8	—	0.3%	May 6, 2025
19Monitor	CVE-2025-4292No exploit	MRCMS Edit User Page edit.do cross site scriptingmrcms · mrcms · CWE-79 XSS	Medium4.8	—	0.3%	May 5, 2025
19Monitor	CVE-2025-25767No exploit	A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarimrcms · mrcms · CWE-266 Pre-auth	Medium4.8	—	0.3%	Feb 21, 2025
19Monitor	CVE-2025-25766No exploit	An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uplmrcms · mrcms · CWE-77 pre-auth RCE File upload Command injection	Medium4.8	—	0.3%	Feb 21, 2025
19Monitor	CVE-2025-50581No exploit	MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do.mrcms · mrcms · CWE-79 XSS	Medium4.8	—	0.2%	Jul 18, 2025
16Monitor	CVE-2025-25765No exploit	MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.mrcms · mrcms	Medium4.0	—	0.2%	Feb 21, 2025

CVE-2026-31272
39Monitor
MRCMS 3.1.2 contains an access control vulnerability.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
mrcms · mrcmsApr 7, 2026
CVE-2024-48177
35Monitor
MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do.
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
mrcms · mrcmsOct 28, 2024
CVE-2024-24161
30Monitor
MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered.
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
mrcms · mrcmsFeb 2, 2024
CVE-2024-25428
26Monitor
SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter.
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- SQL injection
mrcms · mrcmsFeb 20, 2024
CVE-2025-2193
21Monitor
MRCMS org.marker.mushroom.controller.FileController delete.do delete path traversal
MediumCVSS 5.3No exploitEPSS 1%
- Path traversal
mrcms · mrcmsMar 11, 2025
CVE-2026-29909
21Monitor
MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module.
MediumCVSS 5.3Proof of conceptEPSS 1%
- Pre-auth
mrcms · mrcmsMar 30, 2026
CVE-2024-24160
21Monitor
MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do.
MediumCVSS 5.4No exploitEPSS 0%
- XSS
mrcms · mrcmsFeb 2, 2024
CVE-2025-25768
21Monitor
MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.jav
MediumCVSS 5.4No exploitEPSS 0%
- pre-auth RCE
- Command injection
- SSTI
mrcms · mrcmsFeb 21, 2025
CVE-2025-4327
21Monitor
MRCMS cross-site request forgery
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- CSRF
mrcms · mrcmsMay 6, 2025
CVE-2025-2196
20Monitor
MRCMS org.marker.mushroom.controller.FileController upload.do upload cross site scripting
MediumCVSS 5.1No exploitEPSS 0%
- XSS
mrcms · mrcmsMar 11, 2025
CVE-2025-2194
20Monitor
MRCMS org.marker.mushroom.controller.FileController list.do list cross site scripting
MediumCVSS 5.1No exploitEPSS 0%
- XSS
mrcms · mrcmsMar 11, 2025
CVE-2025-2195
20Monitor
MRCMS org.marker.mushroom.controller.FileController rename.do rename cross site scripting
MediumCVSS 5.1No exploitEPSS 0%
- XSS
mrcms · mrcmsMar 11, 2025
CVE-2025-4325
19Monitor
MRCMS Category Management Page add.do cross site scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
mrcms · mrcmsMay 6, 2025
CVE-2025-4293
19Monitor
MRCMS Group Edit Page edit.do cross site scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
mrcms · mrcmsMay 5, 2025
CVE-2025-4323
19Monitor
MRCMS Edit Article Page cross site scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
mrcms · mrcmsMay 6, 2025
CVE-2025-4324
19Monitor
MRCMS External Link Management Page edit.do cross site scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
mrcms · mrcmsMay 6, 2025
CVE-2025-4326
19Monitor
MRCMS Add Fragment Page add.do cross site scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
mrcms · mrcmsMay 6, 2025
CVE-2025-4292
19Monitor
MRCMS Edit User Page edit.do cross site scripting
MediumCVSS 4.8No exploitEPSS 0%
- XSS
mrcms · mrcmsMay 5, 2025
CVE-2025-25767
19Monitor
A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrari
MediumCVSS 4.8No exploitEPSS 0%
- Pre-auth
mrcms · mrcmsFeb 21, 2025
CVE-2025-25766
19Monitor
An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via upl
MediumCVSS 4.8No exploitEPSS 0%
- pre-auth RCE
- File upload
- Command injection
mrcms · mrcmsFeb 21, 2025
CVE-2025-50581
19Monitor
MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do.
MediumCVSS 4.8No exploitEPSS 0%
- XSS
mrcms · mrcmsJul 18, 2025
CVE-2025-25765
16Monitor
MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do.
MediumCVSS 4.0No exploitEPSS 0%
mrcms · mrcmsFeb 21, 2025