PatchTheCVEmcms vulnerabilities and fixes
Recent CVEs affecting mcms, with upgrade or downgrade steps. 6 tracked.
mcms has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-02-18. Highest priority: CVE-2025-56316 (score 60/100).
- CVE-2025-60838 MEDIUM 6.5 UPGRADE An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading
- CVE-2025-60837 MEDIUM 6.1 UPGRADE A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Java
- CVE-2025-29287 CRITICAL 9.8 DOWNGRADE An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arb
- CVE-2026-2666 MEDIUM 4.7 DOWNGRADE A flaw has been found in mingSoft MCMS 6.1.1
- CVE-2025-56316 CRITICAL 9.8 DOWNGRADE A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 a
- CVE-2024-42991 HIGH 8.1 DOWNGRADE MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.
FAQ
How do I fix mcms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mcms being exploited right now?
None of the tracked mcms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mcms CVE should I patch first?
CVE-2025-56316 currently ranks highest (60/100): A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 a.