Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-pn6s-84fa-cba8
Vulnerability ID VCID-pn6s-84fa-cba8
Aliases CVE-2025-29287
GHSA-3922-2r6r-r4fv
Summary MCMS allows arbitrary file uploads in the ueditor component An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 9.8 http://cms.com
ssvc Track* http://cms.com
epss 0.00155 https://api.first.org/data/v1/epss?cve=CVE-2025-29287
cvssv3.1 9.8 https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
generic_textual CRITICAL https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
ssvc Track* https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
cvssv3.1 9.8 https://gitee.com/mingSoft/MCMS/commit/17679d8fae3df2b433478829b01ab05a56ffdbc8
generic_textual CRITICAL https://gitee.com/mingSoft/MCMS/commit/17679d8fae3df2b433478829b01ab05a56ffdbc8
cvssv3.1 9.8 https://gitee.com/mingSoft/MCMS/issues/IBOOTX
generic_textual CRITICAL https://gitee.com/mingSoft/MCMS/issues/IBOOTX
ssvc Track* https://gitee.com/mingSoft/MCMS/issues/IBOOTX
cvssv3.1 9.8 https://github.com/ming-soft/MCMS
generic_textual CRITICAL https://github.com/ming-soft/MCMS
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2025-29287
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2025-29287
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-29287
https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
https://gitee.com/mingSoft/MCMS/commit/17679d8fae3df2b433478829b01ab05a56ffdbc8
https://gitee.com/mingSoft/MCMS/issues/IBOOTX
https://github.com/ming-soft/MCMS
CVE-2025-29287 https://nvd.nist.gov/vuln/detail/CVE-2025-29287
GHSA-3922-2r6r-r4fv https://github.com/advisories/GHSA-3922-2r6r-r4fv
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://cms.com
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-21T14:58:12Z/ Found at http://cms.com
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-21T14:58:12Z/ Found at https://gist.github.com/erdan111/38dcb5150b523436fe01249b2542f02f#file-cve-2025-29287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://gitee.com/mingSoft/MCMS/commit/17679d8fae3df2b433478829b01ab05a56ffdbc8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://gitee.com/mingSoft/MCMS/issues/IBOOTX
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-21T14:58:12Z/ Found at https://gitee.com/mingSoft/MCMS/issues/IBOOTX
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/ming-soft/MCMS
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-29287
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.36007
EPSS Score 0.00155
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:23:51.001408+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/net.mingsoft/ms-mcms/CVE-2025-29287.yml 38.6.0