CVE-2026-4954
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A SQL injection vulnerability was detected in mingSoft MCMS up to version 5.5.0, affecting the list function in ContentAction.java within the Web Content List Endpoint component. Input manipulation leads to SQL injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.
Risk Assessment
The vulnerability could allow an attacker to execute arbitrary SQL queries, potentially resulting in data leakage or privilege escalation. The public exploit increases the risk of attack.
Recommendation
Urgently update mingSoft MCMS to a patched version or implement input validation fixes in the list function. Also restrict access to the content list endpoint.
Other vulnerabilities in mingSoft MCMS
See all- CVE-2026-19357Medium
A security flaw was discovered in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/get in the ms-mdiy component. The attack can be launched remotely. The exploit has been publicly released.
- CVE-2026-19356Medium
A vulnerability was identified in MingSoft MCMS up to version 3.0.6, leading to information disclosure in an unknown function of the file /mdiy/form/data/list in the ms-mdiy component. The attack can be initiated remotely. The exploit is publicly available.
- CVE-2026-19355High
A vulnerability was identified in MingSoft MCMS up to version 3.0.6, affecting the ModelDataImpl.queryDiyFormData function in the file /mdiy/form/data/list.do of the ms-mdiy component. Manipulating the formFields argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS