CVE-2025-56316: Mingsoft Mcms

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.

Affected products

• Mingsoft Mcms: version 5.5.0 only; version 6.0.1 only

Published 2025-10-17. Last modified 2026-06-17.