CVE-2026-4954 - Vulnerability Details

- mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection

Description

A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Published: 2026-03-27

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the list function of the ContentAction class in the Web Content List Endpoint and allows a malicious actor to inject arbitrary SQL statements by manipulating request parameters. This type of injection can lead to data exposure, data modification, or denial of service by exploiting the underlying database. It is classified as a classic SQL injection flaw due to unsanitized input handling.

Affected Systems

The affected product is mingSoft MCMS, specifically all releases up to and including version 5.5.0. The vulnerable code is located in net/mingsoft/cms/action/web/ContentAction.java, part of the Web Content List Endpoint component.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, reflecting the potential for significant data compromise without requiring privilege escalation. The EPSS score is not available, so the likelihood of exploitation cannot be precisely quantified, but the vulnerability is publicly disclosed and can be triggered remotely without any special permissions. The vulnerability is not currently listed in the CISA KeV catalog. An attacker could exploit the flaw by sending crafted HTTP requests to the list endpoint, thereby injecting SQL commands and extracting or manipulating data.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mingSoft

MCMS

affected

Version	Status	Constraints
`5.0`	affected	—
`5.1`	affected	—
`5.2`	affected	—
`5.3`	affected	—
`5.4`	affected	—
`5.5.0`	affected	—

No data.

Vendor Product Confidence Versions

Mingsoft

Mcms

95%

Version	Status	Scheme	Platform
`5.0`	affected	generic	—
`5.1`	affected	generic	—
`5.2`	affected	generic	—
`5.3`	affected	generic	—
`5.4`	affected	generic	—
`5.5.0`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Verify that the deployed version of mingSoft MCMS is 5.5.0 or earlier
Apply the vendor‑issued patch or upgrade to a version beyond 5.5.0 if available
If a patch or upgrade is not yet available, restrict network access to the Web Content List Endpoint and filter input through a WAF
Monitor web server logs for anomalous SQL queries and block offending IP addresses

Generated by OpenCVE AI on March 28, 2026 at 06:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00029.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/wing3e/public_exp/issues/4
https://vuldb.com/?ctiid.353832
https://vuldb.com/?id.353832
https://vuldb.com/?submit.777533

History

Sat, 28 Mar 2026 03:15:00 +0000

Type	Values Removed	Values Added
Description	A security vulnerability has been detected in mingSoft MCMS 迄 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.	A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

Fri, 27 Mar 2026 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 27 Mar 2026 14:30:00 +0000

Type	Values Removed	Values Added
Description		A security vulnerability has been detected in mingSoft MCMS 迄 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Title		mingSoft MCMS Web Content List Endpoint ContentAction.java list sql injection
First Time appeared		Mingsoft Mingsoft mcms
Weaknesses		CWE-74 CWE-89
CPEs		cpe:2.3:a:mingsoft:mcms::::::::
Vendors & Products		Mingsoft Mingsoft mcms
References		https://github.com/wing3e/public_exp/issues/4 https://vuldb.com/?ctiid.353832 https://vuldb.com/?id.353832 https://vuldb.com/?submit.777533
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Mingsoft Mcms

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-03-27T14:13:38.633Z

Updated: 2026-03-27T22:16:13.177Z

Reserved: 2026-03-27T07:53:22.716Z

Link: CVE-2026-4954

Vulnrichment

Updated: 2026-03-27T14:46:32.463Z

NVD

Status : Awaiting Analysis

Published: 2026-03-27T15:17:02.820

Modified: 2026-03-30T13:26:29.793

Link: CVE-2026-4954

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-03-30T07:01:50Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object