CVE-2025-60837: Mingsoft Mcms

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.

Affected products

• Mingsoft Mcms: up to and including 6.0.1

Published 2025-10-23. Last modified 2026-07-05.