Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

mingSoft MCMS 迄 5.5.0 allows remote attackers to forge server requests

CVE-2026-4953 · published 7 months ago
Summary

The mingSoft MCMS 迄 5.5.0 software has a security weakness that allows hackers to trick the server into making unauthorized requests on their behalf. This could be used to gain unauthorized access or disrupt the server's operations. To protect your system, update to a newer version of mingSoft MCMS.

Original advisory text
A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/BaseAction.java of the component Editor Endpoint. Executi...
A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/BaseAction.java of the component Editor Endpoint. Executing a manipulation of the argument catchimage can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published27 Mar 2026
Updated3 Nov 2026
First seen27 Mar 2026
Sources
CVE-2026-4953 · NVD
Track software like this
Free during beta