GHSA-mx3x-rmrh-9wf6 CVE-2022-26585
SQL injection in net.mingsoft:ms-mcms
High
Maven
- Severity
- High
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 5.47%
- Chance of exploitation in the next 30 days. Higher than 92.76% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| net.mingsoft:ms-mcms | <= 5.2.7 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-r9wp-qq53-qvjx mingSoft MCMS does not properly restrict file uploads | High | Also affects net.mingsoft:ms-mcms |
| GHSA-wvv5-5g6x-hp7j MCMS reflected cross-site scripting (XSS) vulnerability | Medium | Also affects net.mingsoft:ms-mcms |
| GHSA-54wc-49qj-5ghj MCMS vulnerable SQL injection via the content_title parameter | Critical | Also affects net.mingsoft:ms-mcms |
| GHSA-3922-2r6r-r4fv MCMS allows arbitrary file uploads in the ueditor component | Critical | Also affects net.mingsoft:ms-mcms |
| GHSA-7qw4-9r68-2rmx mingSoft MCMS File Upload vulnerability | High | Also affects net.mingsoft:ms-mcms |
| GHSA-h57w-vh34-f8cw Code injection in mingSoft MCMS | High | Also affects net.mingsoft:ms-mcms |
| GHSA-3vvh-8c65-32j4 Mingsoft MCMS SQL injection | Critical | Also affects net.mingsoft:ms-mcms |
| GHSA-rxvj-5mv6-j5mc Cross-site Scripting in Mingsoft MCMS | Medium | Also affects net.mingsoft:ms-mcms |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor