Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-84a8-412b-3uhn
Vulnerability ID VCID-84a8-412b-3uhn
Aliases CVE-2023-3990
GHSA-rxvj-5mv6-j5mc
Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
Status Published
Exploitability 0.5
Weighted Severity 3.1
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.11956 https://api.first.org/data/v1/epss?cve=CVE-2023-3990
cvssv3.1 3.5 https://gitee.com/mingSoft/MCMS/issues/I7K4DQ
generic_textual LOW https://gitee.com/mingSoft/MCMS/issues/I7K4DQ
cvssv3.1 3.5 https://github.com/ming-soft/MCMS
generic_textual LOW https://github.com/ming-soft/MCMS
cvssv3.1 3.5 https://nvd.nist.gov/vuln/detail/CVE-2023-3990
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2023-3990
cvssv3.1 3.5 https://vuldb.com/?ctiid.235611
generic_textual LOW https://vuldb.com/?ctiid.235611
cvssv3.1 3.5 https://vuldb.com/?id.235611
generic_textual LOW https://vuldb.com/?id.235611
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-3990
https://gitee.com/mingSoft/MCMS/issues/I7K4DQ
https://github.com/ming-soft/MCMS
https://vuldb.com/?ctiid.235611
https://vuldb.com/?id.235611
CVE-2023-3990 https://nvd.nist.gov/vuln/detail/CVE-2023-3990
GHSA-rxvj-5mv6-j5mc https://github.com/advisories/GHSA-rxvj-5mv6-j5mc
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://gitee.com/mingSoft/MCMS/issues/I7K4DQ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/ming-soft/MCMS
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-3990
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://vuldb.com/?ctiid.235611
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://vuldb.com/?id.235611
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.93901
EPSS Score 0.11956
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:45:28.332362+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/net.mingsoft/ms-mcms/CVE-2023-3990.yml 38.6.0