9.8
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.
AI Analysis
SQL injection vulnerability in MCMS content_title parameter
Basic Information
ID
CVE-2025-56316
Source
mitre
Published
Oct 17, 2025 at 00:00
Modified
Oct 20, 2025 at 19:53
Affected Product
Vendor
Ming-Soft
Product
MCMS
Version
5.5.0
Affected Versions
n/a n/a n/a
CWE Classification
AI Assessment
AI Score
9.8 / 10
AI Severity
Critical
Vendor
Ming-Soft
Product
MCMS
Version
5.5.0