Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-pgm5-u97w-mkft
Vulnerability ID VCID-pgm5-u97w-mkft
Aliases CVE-2025-60837
GHSA-wvv5-5g6x-hp7j
Summary MCMS reflected cross-site scripting (XSS) vulnerability A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 6.1 http://mcms.com
generic_textual MODERATE http://mcms.com
ssvc Track http://mcms.com
epss 0.00024 https://api.first.org/data/v1/epss?cve=CVE-2025-60837
cvssv3.1 6.1 https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a
generic_textual MODERATE https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a
ssvc Track https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a
cvssv3.1 6.1 https://gitee.com/mingSoft/MCMS
generic_textual MODERATE https://gitee.com/mingSoft/MCMS
ssvc Track https://gitee.com/mingSoft/MCMS
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-wvv5-5g6x-hp7j
cvssv3.1 6.1 https://github.com/ming-soft/MCMS
generic_textual MODERATE https://github.com/ming-soft/MCMS
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2025-60837
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-60837
Reference id Reference type URL
http://mcms.com
https://api.first.org/data/v1/epss?cve=CVE-2025-60837
https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a
https://gitee.com/mingSoft/MCMS
https://github.com/ming-soft/MCMS
CVE-2025-60837 https://nvd.nist.gov/vuln/detail/CVE-2025-60837
GHSA-wvv5-5g6x-hp7j https://github.com/advisories/GHSA-wvv5-5g6x-hp7j
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at http://mcms.com
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T20:34:02Z/ Found at http://mcms.com
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T20:34:02Z/ Found at https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://gitee.com/mingSoft/MCMS
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-23T20:34:02Z/ Found at https://gitee.com/mingSoft/MCMS
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/ming-soft/MCMS
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-60837
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.07221
EPSS Score 0.00024
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:48:14.091511+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/net.mingsoft/ms-mcms/CVE-2025-60837.yml 38.6.0