critical9.8
CVE-2021-46386
Mingsoft MCMS vulnerable to Remote Code Execution via file upload.
Impact
Mingsoft MCMS is a Java CMS. Versions prior to and including 5.2.5 contain a file upload vulnerability allowing for a jspx webshell to be uploaded via net.mingsoft.basic.action.web.FileAction#upload, resulting in remote code execution. It is unclear if this issue has been patched.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | net.mingsoft:ms-mcms | <= 5.2.5 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mingsoft | Mcms | through 5.2.5 |