File and Path Handling

Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.

1. File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.CVE-2024-22567Mingsoft · CVSS 8.8 · 18% likely

   CWE-434

2. An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.CVE-2021-46036Mingsoft · 3.7% likely

   CWE-434

3. File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction…CVE-2021-46386Mingsoft · 3.1% likely

   CWE-434

4. An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.CVE-2022-30506Mingsoft · 2.7% likely

   CWE-434

5. MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.CVE-2022-22929Mingsoft · 2.7% likely

   CWE-434

6. MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component /ms/template/writeFileContent.do.CVE-2022-23315Mingsoft · 1.9% likely

   CWE-434

7. An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via…CVE-2018-18831Mingsoft · 1.5% likely

   CWE-22

8. MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.CVE-2022-31943Mingsoft · 1.5% likely

   CWE-434

9. An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interfac…CVE-2018-18830Mingsoft · 1.2% likely

   CWE-434

10. MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.CVE-2022-47042Mingsoft · CVSS 8.8 · 1.0% likely

    CWE-434

11. File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.CVE-2020-22755Mingsoft · CVSS 8.8 · 0.9% likely

    CWE-434

12. MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution.CVE-2024-42991Mingsoft · CVSS 8.1 · 0.8% likely

    CWE-434

13. An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.CVE-2025-29287Mingsoft · CVSS 9.8 · 0.8% likely

    CWE-434

14. mingSoft MCMS Template Archive uploadTemplate.do unrestricted uploadCVE-2026-2666mingSoft · CVSS 4.7 · 0.4% likely

    CWE-434

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.