Threat database

MCMS versions 6.1.1 through 6.2.1 contain a critical SQL injection vulnerability in the custom model/form import feature. This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS score of 9.8, indicating critical severity. No patch or remediation information is currently provided.

MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.

A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.

A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.

MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.