CVE-2025-60837
Medium · 6.1CVSS
6.1
EPSS
0.2%
Published
Oct 23, 2025
CISA due date
—
The record
A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | net.mingsoft:ms-mcms | 0 | No fix |
Related vulnerabilities
- CVE-2026-2666 A flaw has been found in mingSoft MCMS 6.1.1. Also affects net.mingsoft:ms-mcms
- CVE-2024-22567 File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via… Also affects net.mingsoft:ms-mcms
- CVE-2022-22930 A remote code execution (RCE) vulnerability in the Template Management function of MCMS… Also affects net.mingsoft:ms-mcms
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79