Mrcms
Mrcms: vulnerabilidades y CVE
Mrcms tiene 22 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 1 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE22
Últimos 12 meses2
Críticas1
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-31272 | Crítica (9.8) | 0.65% | — | 7 abr 2026 | MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper authorization validation, enabling direct addition of super… |
| CVE-2026-29909 | Media (5.3) | 0.50% | — | 30 mar 2026 | MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote… |
| CVE-2025-50581 | Media (4.8) | 0.19% | — | 18 jul 2025 | MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do. |
| CVE-2025-4327 | Media (5.3) | 0.27% | — | 6 may 2025 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The… |
| CVE-2025-4326 | Media (4.8) | 0.31% | — | 6 may 2025 | A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects some unknown processing of the file /admin/chip/add.do of the component Add Fragment Page. The manipulation leads to cross site… |
| CVE-2025-4325 | Media (4.8) | 0.37% | — | 6 may 2025 | A vulnerability has been found in MRCMS 3.1.2 and classified as problematic. This vulnerability affects unknown code of the file /admin/category/add.do of the component Category Management Page. The manipulation of the… |
| CVE-2025-4324 | Media (4.8) | 0.31% | — | 6 may 2025 | A vulnerability, which was classified as problematic, was found in MRCMS 3.1.2. This affects an unknown part of the file /admin/link/edit.do of the component External Link Management Page. The manipulation leads to… |
| CVE-2025-4323 | Media (4.8) | 0.31% | — | 6 may 2025 | A vulnerability, which was classified as problematic, has been found in MRCMS 3.1.2. Affected by this issue is some unknown functionality of the component Edit Article Page. The manipulation of the argument Title leads… |
| CVE-2025-4293 | Media (4.8) | 0.31% | — | 5 may 2025 | A vulnerability was found in MRCMS 3.1.3 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/group/edit.do of the component Group Edit Page. The manipulation leads to… |
| CVE-2025-4292 | Media (4.8) | 0.31% | — | 5 may 2025 | A vulnerability has been found in MRCMS 3.1.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/user/edit.do of the component Edit User Page. The manipulation… |
| CVE-2025-2196 | Media (5.1) | 0.40% | — | 11 mar 2025 | A vulnerability was found in MRCMS 3.1.2. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /admin/file/upload.do of the component… |
| CVE-2025-2195 | Media (5.1) | 0.36% | — | 11 mar 2025 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is the function rename of the file /admin/file/rename.do of the component org.marker.mushroom.controller.FileController. The… |
| CVE-2025-2194 | Media (5.1) | 0.36% | — | 11 mar 2025 | A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects the function list of the file /admin/file/list.do of the component org.marker.mushroom.controller.FileController. The… |
| CVE-2025-2193 | Media (5.3) | 0.80% | — | 11 mar 2025 | A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of the component org.marker.mushroom.controller.FileController.… |
| CVE-2025-25768 | Media (5.4) | 0.34% | — | 21 feb 2025 | MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted… |
| CVE-2025-25767 | Media (4.8) | 0.33% | — | 21 feb 2025 | A vertical privilege escalation vulnerability in the component /controller/UserController.java of MRCMS v3.1.2 allows attackers to arbitrarily delete users via a crafted request. |
| CVE-2025-25766 | Media (4.8) | 0.32% | — | 21 feb 2025 | An arbitrary file upload vulnerability in the component /file/savefile.do of MRCMS v3.1.2 allows attackers to execute arbitrary code via uploading a crafted .jsp file. |
| CVE-2025-25765 | Media (4) | 0.19% | — | 21 feb 2025 | MRCMS v3.1.2 was discovered to contain an arbitrary file write vulnerability via the component /file/save.do. |
| CVE-2024-48177 | Alta (8.8) | 0.43% | — | 28 oct 2024 | MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do. |
| CVE-2024-25428 | Media (6.5) | 0.40% | — | 20 feb 2024 | SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter. |
| CVE-2024-24161 | Alta (7.5) | 0.69% | — | 2 feb 2024 | MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered. |
| CVE-2024-24160 | Media (5.4) | 0.43% | — | 2 feb 2024 | MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.