CVE-2025-56316: SQL Injection Vulnerability in net.mingsoft:ms-mcms Package
Summary
CVE-2025-56316: MCMS vulnerable SQL injection via the content_title parameter. Affects net.mingsoft:ms-mcms versions >= 5.5.0, < 6.0.2. Fixed in 6.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net.mingsoft:ms-mcms package is a content management system (CMS) designed for building and managing web content. It provides features such as content creation, editing, and publishing, making it a popular choice for developers looking to implement CMS solutions. However, versions 5.5.0 through 6.0.1 of this package are vulnerable to a SQL injection attack, which can allow attackers to manipulate database queries through unsanitized input.
Vulnerability Detail
A SQL injection vulnerability exists in the content_title parameter of the /cms/content/list endpoint in MCMS versions 5.5.0 to 6.0.1. This vulnerability allows remote attackers to execute arbitrary SQL queries by injecting malicious input into the FreeMarker template rendering process. The lack of proper input sanitization is the root cause, leading to potential data breaches, unauthorized access, and manipulation of the database.
How To Fix
Latest published version: 6.2.2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that all user inputs, especially those related to the content_title parameter, are properly sanitized and validated before processing. Implementing input validation can help mitigate the risk of SQL injection until the package is updated.
Conclusion
The SQL injection vulnerability identified as CVE-2025-56316 in the net.mingsoft:ms-mcms package poses a significant risk to applications using versions 5.5.0 through 6.0.1. It is crucial to update to version 6.0.2 or later to protect against potential attacks. Additionally, implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for net.mingsoft:ms-mcms →
FAQ
SQL injection is a code injection technique that exploits vulnerabilities in an application's software by allowing attackers to interfere with the queries that an application makes to its database.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to analyze your pom.xml without any signup.
If exploited, this vulnerability can lead to unauthorized access to sensitive data, data manipulation, and even complete control over the database, posing significant risks to the integrity and confidentiality of the application.
Yes, a patch is available in version 6.0.2 of the net.mingsoft:ms-mcms package. It is recommended to update to this version to mitigate the vulnerability.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for net.mingsoft:ms-mcms.
