PT-2025-43542 · Mcms · Mcms

Published 2025-10-23 · Updated 2025-10-26 · CVE-2025-60837

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MCMS version 6.0.1

Description A reflected cross-site scripting (XSS) issue exists in MCMS version 6.0.1. This allows attackers to execute arbitrary Javascript in the context of a user’s browser through a crafted payload. The attack vector involves a reflected XSS, meaning the malicious script is triggered when a user interacts with a specially crafted link or form.

Recommendations Update MCMS to a version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-60837

GHSA-WVV5-5G6X-HP7J

Affected Products

Mcms

References · 14

• https://osv.dev/vulnerability/CVE-2025-60837 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wvv5-5g6x-hp7j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60837 · Security Note
• https://github.com/ming-soft/MCMS · Note
• https://reddit.com/r/VulnMatter/comments/1ogn557/resumen_diario_de_vulnerabilidades_26102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1oezejc/resumen_diario_de_vulnerabilidades_24102025 · Reddit Post
• https://t.me/cveNotify/140110 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1ogywhf/resumen_diario_de_vulnerabilidades_26102025 · Reddit Post
• https://twitter.com/CVEnew/status/1981438896073244976 · Twitter Post
• https://gist.github.com/xuzhiwei66666666/5cec37c9f674a08bc0d8654d42b4137a · Note
• https://gitee.com/mingSoft/MCMS · Note
• https://twitter.com/VulmonFeeds/status/1981469036719268056 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ofsmpa/resumen_diario_de_vulnerabilidades_25102025 · Reddit Post
• http://mcms.com · Note