CVE-2026-88416
Low risk· EPSS 8%Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
Risk Assessment
An attacker could inject malicious SQL queries, potentially leading to data leakage, modification, or deletion from the database.
Recommendation
Update MCMS to a patched version or disable the custom model/form import feature until a fix is applied.
Other vulnerabilities in MCMS
See all- CVE-2026-68000Critical
The /cms/category/list interface in MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause via FreeMarker ${size} without parameterization. The SqlInjectionUtil filter does not block keywords like CREATE/TABLE/SET/PREPARE/EXECUTE, allowing bypass and execution of stacked SQL statements without login.
- CVE-2025-29287Critical
An arbitrary file upload vulnerability was found in the ueditor component of MCMS version 5.4.3. Attackers can exploit this flaw to execute arbitrary code by uploading a crafted file.
- CVE-2026-88415High
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS). The article content field `contentDetails` is excluded from the global XSS filter.
- CVE-2026-88414Low risk· EPSS 10%
MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).
- CVE-2026-52203High
Vulnerability in MCMS version 6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.
- CVE-2025-60837Medium
A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload.
- CVE-2025-60838Medium
An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code by uploading a crafted file.
Original NVD description (English source)
MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS