The MCMS front‑end interface at /cms/category/list is vulnerable to SQL injection in versions 6.2.0 and earlier. The size query parameter is directly concatenated into the SQL LIMIT clause using FreeMarker ${size} without parameterization or binding. The built‑in SqlInjectionUtil filters input with a regular‑expression blacklist that omits critical keywords such as CREATE, TABLE, SET, PREPARE, EXECUTE, allowing an attacker to bypass the filter and inject arbitrary SQL statements.

Any deployment of MCMS up to version 6.2.0 is affected. The product is listed only as MCMS, with no vendor or product name provided in the CNA data. Exposing the /cms/category/list endpoint to the internet or internal users makes the system vulnerable.

The flaw is exploited via unauthenticated HTTP requests to the vulnerable endpoint. An attacker can execute stacked SQL statements, potentially compromising data confidentiality, integrity, and availability. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, but the lack of authentication and ability to run arbitrary SQL suggest a high exploitation risk for exposed installations. The CVSS base score is 9.8, indicating critical severity.