https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2666.htmlhttps://patchthecve.com/cve/CVE-2026-2666.htmlWed, 17 Jun 2026 10:31:30 +0000MEDIUM 4.7: A flaw has been found in mingSoft MCMS 6.1.1. The affected element is an unknown function of the file /ms/file/uploadTemplate.do of the component Template Archive Handler. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit https://patchthecve.com/cve/CVE-2025-60837.htmlhttps://patchthecve.com/cve/CVE-2025-60837.htmlSun, 05 Jul 2026 02:17:15 +0000MEDIUM 6.1: A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.https://patchthecve.com/cve/CVE-2025-56316.htmlhttps://patchthecve.com/cve/CVE-2025-56316.htmlWed, 17 Jun 2026 09:42:31 +0000CRITICAL 9.8: A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.https://patchthecve.com/cve/CVE-2025-60838.htmlhttps://patchthecve.com/cve/CVE-2025-60838.htmlSun, 05 Jul 2026 02:17:15 +0000MEDIUM 6.5: An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file.https://patchthecve.com/cve/CVE-2025-29287.htmlhttps://patchthecve.com/cve/CVE-2025-29287.htmlSun, 05 Jul 2026 01:21:39 +0000CRITICAL 9.8: An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.https://patchthecve.com/cve/CVE-2024-42991.htmlhttps://patchthecve.com/cve/CVE-2024-42991.htmlWed, 17 Jun 2026 07:50:14 +0000HIGH 8.1: MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.