CyberSecBulletin

MRCMS vulnerabilities

We track 2 vulnerabilities in MRCMS products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 7, 2026.

2vulnerabilities
1critical
1high
0exploited
8.9average CVSS score

Latest MRCMS vulnerabilities

  • 9.8 Critical severity

    Mrcms: Improper Access Control

    CVE-2026-31272MRCMS

    MRCMS 3.1.2 contains an access control vulnerability. The save() method in src/main/java/org/marker/mushroom/controller/UserController.java lacks proper authorization validation, enabling direct addition of super administrator accounts without authentication.

  • 8.1 High severity

    MRCMS: Improper Limitation of a Pathname to a Restricted Directory

    CVE-2025-2193MRCMS

    A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path/nam