GitHub Advisoryadvisory · Maven

GHSA-54wc-49qj-5ghj MCMS vulnerable SQL injection via the content_title parameter

CRITICAL Published 2025-10-17 Modified 2025-10-21 Official page ↗
Aliases
CVE-2025-56316
Ecosystem
Maven
Packages
net.mingsoft:ms-mcms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2025-10-21

Affected packages

• Maven net.mingsoft:ms-mcms: >= 5.5.0, < 6.0.2 → fixed in 6.0.2

Description

A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 through 6.0.1 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.

Related

Alias · CVE (1)

  • CVE-2025-56316 A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References