GHSA-54wc-49qj-5ghj

ghsaUSosv

MCMS vulnerable SQL injection via the content_title parameter

view advisory published 2025-10-17Licence: CC-BY-4.0

A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 through 6.0.1 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-56316US	—	0.64% (50th)	—	2025-10-17
A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitize…

references

External citations — patches, advisories, analysis.

https://gist.github.com/Erosion2020/5892757e0c6eeb647a218d1c3b323cffWEB
https://github.com/ming-soft/MCMSPACKAGE
https://github.com/ming-soft/MCMS/commit/35ccbf1e3d38ab6aa178524a47c38dff6b448b59WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-56316ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan