CVE-2025-25768: Mrcms

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Affected products

• Mrcms Mrcms: version 3.1.2 only

Published 2025-02-21. Last modified 2026-06-17.