Microsoft Content Management Server vulnerabilities

6 CVEs affecting Microsoft Content Management Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2007-0939, published 2007-04-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2007-0938, published 2007-04-10. High severity, CVSS 10.0. EPSS: 45.6% chance of exploitation in the next 30 days. Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 does not properly handle certain characters in a crafted HTTP GET request, which allows remote attackers to execute arbitrary code,…
CVE-2003-0002, published 2003-02-07. Medium severity, CVSS 6.8. EPSS: 23.3% chance of exploitation in the next 30 days. Cross-site scripting vulnerability (XSS) in ManualLogin.asp script for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary script via the REASONTXT parameter.
CVE-2007-0939, published 2007-04-10. Medium severity, CVSS 4.3. EPSS: 16.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors…
CVE-2002-0719, published 2002-08-12. High severity, CVSS 7.5. EPSS: 10.4% chance of exploitation in the next 30 days. SQL injection vulnerability in the function that services for Microsoft Content Management Server (MCMS) 2001 allows remote attackers to execute arbitrary commands via an MCMS resource request for…
CVE-2002-0700, published 2002-08-12. High severity, CVSS 7.5. EPSS: 7.9% chance of exploitation in the next 30 days. Buffer overflow in a system function that performs user authentication for Microsoft Content Management Server (MCMS) 2001 allows attackers to execute code in the Local System context by…
CVE-2002-0718, published 2002-08-12. High severity, CVSS 7.5. EPSS: 6% chance of exploitation in the next 30 days. Web authoring command in Microsoft Content Management Server (MCMS) 2001 allows attackers to authenticate and upload executable content, by modifying the upload location, aka "Program Execution via…