CVE-2025-56316: MCMS vulnerable SQL injection via the content_title parameter

October 17, 2025 (updated October 21, 2025)

A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 through 6.0.1 allows remote attackers to execute arbitrary SQL queries via unsanitized input in the FreeMarker template rendering.

References

gist.github.com/Erosion2020/5892757e0c6eeb647a218d1c3b323cff
github.com/advisories/GHSA-54wc-49qj-5ghj
github.com/ming-soft/MCMS
github.com/ming-soft/MCMS/commit/35ccbf1e3d38ab6aa178524a47c38dff6b448b59
nvd.nist.gov/vuln/detail/CVE-2025-56316

Code Behaviors & Features

Detect and mitigate CVE-2025-56316 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →