Is CVE-2026-88415 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88415 being exploited in the wild.

How severe is CVE-2026-88415?

High severity, with a CVSS score of 8.7, published 22 September 2026.

Which products and versions are affected?

Mingsoft Mcms 6.1.1, 6.2.0, 6.2.1.

Is there a fix for CVE-2026-88415?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88415 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-88415?

Check whether you run Mingsoft Mcms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88415: MCMS stored Cross-Site Scripting in article content field

CVE-2026-88415 · Severity: high · CVSS 8.7 · Published 2026-09-22

MCMS is a Java-based content management system that allows authors to publish articles to static HTML pages. An attacker with backend access can inject malicious JavaScript into the article content field, which bypasses the application's XSS filters and gets stored in the database. When the article is published, the malicious code executes in the browsers of visitors to the website, allowing the attacker to steal session cookies, credentials, or deface content.

Technologies: Mingsoft Mcms. Vendors: Mingsoft.

Quick answers

Is CVE-2026-88415 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88415 being exploited in the wild.
How severe is CVE-2026-88415?: High severity, with a CVSS score of 8.7, published 22 September 2026.
Which products and versions are affected?: Mingsoft Mcms 6.1.1, 6.2.0, 6.2.1.
Is there a fix for CVE-2026-88415?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88415 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-88415?: Check whether you run Mingsoft Mcms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS in the contentDetails field of article creation. The field is explicitly excluded from the global XSS filter (XSSEscapeFilter), and the remaining regex-based blacklist (@Xss annotation via JsoupUtil.hasXSS) is incomplete, missing event handlers like onmouseover. Payloads like <svg/onmouseover=alert()> bypass validation, are stored raw in the database, and rendered without HTML escaping by FreeMarker templates during static page generation, executing in the victim's browser context.

Affected products

MingSoft MCMS 6.1.1, 6.2.0, 6.2.1

Timeline

2026-09-22: disclosed

References

https://github.com/15536818056/CVE/issues/2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.