CVE-2026-88415
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.
Risk Assessment
An attacker can inject a malicious script that is stored and executed in other users' browsers, potentially leading to session or data theft. This may compromise the security of MCMS users.
Recommendation
Update MCMS to a version newer than 6.2.1 once a fix is available. Until then, consider enabling additional filtering for the `contentDetails` field.
Other vulnerabilities in MCMS
See all- CVE-2026-68000Critical
The /cms/category/list interface in MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause via FreeMarker ${size} without parameterization. The SqlInjectionUtil filter does not block keywords like CREATE/TABLE/SET/PREPARE/EXECUTE, allowing bypass and execution of stacked SQL statements without login.
- CVE-2025-29287Critical
An arbitrary file upload vulnerability was found in the ueditor component of MCMS version 5.4.3. Attackers can exploit this flaw to execute arbitrary code by uploading a crafted file.
- CVE-2026-88416Low risk· EPSS 8%
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
- CVE-2026-88414Low risk· EPSS 10%
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
- CVE-2026-52203High
Vulnerability in MCMS version 6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.
- CVE-2025-60837Medium
A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload.
- CVE-2025-60838Medium
An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code by uploading a crafted file.
Original NVD description (English source)
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS