Mccms
Vendor:
First CVE: Apr 28, 2023 · Active for 3 years
11
Total CVEs
More Total CVEs than 89% of tracked products
5.5
Avg CVEs / Year
Higher CVE frequency than 89% of tracked products
7.9
Avg CVSS
Higher Avg CVSS than 68% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Mccms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Apr 28, 2023
3 years ago
Most Recent CVE
Aug 21, 2025
337 days ago
CVE Severity & Scoring
Mccms11 CVEs
36%
55%
9%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network10 (90.9%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network1 (9.1%)
Attack Complexity
Low11 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None9 (81.8%)
Unknown0 (0.0%)
Required2 (18.2%)
Privileges Required
Low7 (63.6%)
High0 (0.0%)
None4 (36.4%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-3236HIGH A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function pic_save of the file sys/apps/controllers/admin/Comic.php. The manipulation of | Jun 14, 2023 | 8.8 | 28 | NO | NO |
CVE-2023-26781CRITICAL SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search. | Apr 28, 2023 | 9.8 | 28 | NO | NO |
CVE-2023-29815HIGH mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF). | Apr 28, 2023 | 8.8 | 26 | NO | NO |
CVE-2025-5328HIGH A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restore_del of the file /sys/apps/controllers/admin/Backup | May 29, 2025 | 8.8 | 24 | NO | NO |
CVE-2023-3235HIGH A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function pic_api of the file sys/apps/controllers/admin/Comic.php. The | Jun 14, 2023 | 8.8 | 24 | NO | NO |
CVE-2025-50234MEDIUM MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypt | Aug 6, 2025 | 6.5 | 23 | NO | NO |
CVE-2025-5327HIGH A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of | May 29, 2025 | 8.8 | 23 | NO | NO |
CVE-2023-5029HIGH A vulnerability, which was classified as critical, was found in mccms 2.6. This affects an unknown part of the file /category/order/hits/copyright/46/finish/1/list/1. The manipulat | Sep 17, 2023 | 8.8 | 22 | NO | NO |
CVE-2023-26782MEDIUM An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configuration->Cache Configuration->Cache security | Apr 28, 2023 | 6.5 | 21 | NO | NO |
CVE-2025-51818MEDIUM MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands | Aug 21, 2025 | 5.4 | 19 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Mccms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.7 | 5 | 7.0 | 0.4% | 0 | 0 |
| 2.6.3 | 1 | 8.8 | 0.3% | 0 | 0 |
| 2.6.1 | 1 | 6.5 | 0.9% | 0 | 0 |
| 2.6 | 2 | 9.3 | 0.8% | 0 | 0 |