IDCVSSSummaryLast (major) updatePublished
CVE-2007-5056 6.8
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequ
29-09-2017 - 01:29 24-09-2007 - 22:17
CVE-2014-0334 3.5
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the
24-07-2015 - 18:32 02-03-2014 - 17:55
CVE-2007-2473 7.5
SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter. The vendor has addressed this issue with the following product update: http://
29-07-2017 - 01:31 02-05-2007 - 23:19
CVE-2007-6656 7.5
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
29-09-2017 - 01:30 04-01-2008 - 11:46
CVE-2010-1482 4.3
Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.
13-05-2010 - 04:00 12-05-2010 - 16:05
CVE-2010-2797 7.5
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demons
11-10-2010 - 17:14 08-10-2010 - 21:00
CVE-2010-3882 4.3
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (
11-10-2010 - 17:42 08-10-2010 - 21:00
CVE-2010-3883 6.8
Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications.
11-10-2010 - 17:45 08-10-2010 - 21:00
CVE-2010-3884 6.8
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information
27-11-2018 - 14:32 08-10-2010 - 21:00
CVE-2010-4663 10.0
Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.
27-04-2012 - 04:00 08-06-2011 - 10:36
CVE-2012-1992 4.3
Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).
20-11-2012 - 04:44 11-04-2012 - 10:39
CVE-2012-5450 6.8
Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files v
29-08-2017 - 01:32 03-12-2012 - 21:55
CVE-2012-6064 3.5
Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be
29-08-2017 - 01:32 03-12-2012 - 21:55
CVE-2013-4167 4.3
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
15-10-2013 - 14:54 11-10-2013 - 22:55
CVE-2014-2245 6.0
SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOT
07-03-2014 - 19:43 05-03-2014 - 16:37
CVE-2016-7904 6.0
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.
27-01-2017 - 16:48 16-01-2017 - 06:59
CVE-2017-1000453 7.5
CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
16-01-2018 - 18:19 02-01-2018 - 17:29
CVE-2017-1000454 4.6
CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1
16-01-2018 - 18:24 02-01-2018 - 17:29
CVE-2017-17734 5.0
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.
04-01-2018 - 15:18 18-12-2017 - 06:29
CVE-2017-17735 5.0
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.
04-01-2018 - 15:18 18-12-2017 - 06:29
CVE-2017-6070 7.5
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
23-02-2017 - 14:55 21-02-2017 - 07:59
CVE-2017-6071 5.0
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.
23-02-2017 - 14:55 21-02-2017 - 07:59
CVE-2017-6072 5.0
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
23-02-2017 - 14:56 21-02-2017 - 07:59
CVE-2018-10029 3.5
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
13-04-2018 - 19:27 11-04-2018 - 19:29
CVE-2018-10030 6.8
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
13-04-2018 - 19:26 11-04-2018 - 19:29
CVE-2018-10031 6.8
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
13-04-2018 - 19:28 11-04-2018 - 19:29
CVE-2018-10032 3.5
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
13-04-2018 - 19:26 11-04-2018 - 19:29
CVE-2018-10033 3.5
CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
13-04-2018 - 19:28 11-04-2018 - 19:29
CVE-2018-10081 5.0
CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring.
17-04-2018 - 17:00 13-04-2018 - 05:29
CVE-2018-10082 5.0
CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.tas
13-04-2018 - 19:28 13-04-2018 - 05:29
CVE-2018-10083 6.4
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict th
13-04-2018 - 19:28 13-04-2018 - 05:29
CVE-2018-10084 6.5
CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism
03-10-2019 - 00:03 13-04-2018 - 05:29
CVE-2018-10085 7.5
CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code,
13-04-2018 - 19:27 13-04-2018 - 05:29
CVE-2018-10086 6.5
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunc
03-10-2019 - 00:03 13-04-2018 - 05:29
CVE-2018-10515 6.5
In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive.
24-05-2018 - 17:11 27-04-2018 - 18:29
CVE-2018-10516 5.5
In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory.
24-05-2018 - 17:11 27-04-2018 - 18:29
CVE-2018-10517 6.5
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
15-03-2019 - 18:07 27-04-2018 - 18:29
CVE-2018-10518 8.5
In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all dir
03-10-2019 - 00:03 27-04-2018 - 18:29
CVE-2018-10520 8.5
In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all d
03-10-2019 - 00:03 27-04-2018 - 18:29
CVE-2018-10521 4.0
In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory
24-05-2018 - 16:23 27-04-2018 - 18:29
CVE-2018-10522 4.0
In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_c
24-05-2018 - 15:45 27-04-2018 - 18:29
CVE-2018-10523 5.0
CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileMa
24-05-2018 - 15:44 27-04-2018 - 18:29
CVE-2019-11513 3.5
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
27-04-2019 - 00:49 25-04-2019 - 03:29
CVE-2019-9055 6.5
An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call wi
27-03-2019 - 13:15 26-03-2019 - 17:29
CVE-2019-9057 6.5
An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.
27-03-2019 - 03:00 26-03-2019 - 17:29
CVE-2019-9058 6.5
An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
27-03-2019 - 02:54 26-03-2019 - 17:29
CVE-2019-9059 6.5
An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching th
27-03-2019 - 02:54 26-03-2019 - 17:29
CVE-2019-9061 6.5
An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install mo
27-03-2019 - 02:53 26-03-2019 - 17:29
CVE-2019-9692 4.0
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).
02-04-2019 - 18:42 11-03-2019 - 18:29
CVE-2019-9693 6.5
In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo
12-03-2019 - 13:16 11-03-2019 - 18:29
CVE-2011-4310 5.0
The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
26-11-2019 - 23:15 26-11-2019 - 23:15
CVE-2005-2846 7.5
PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter.
18-10-2016 - 03:30 08-09-2005 - 10:03
CVE-2005-3083 4.3
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
18-10-2016 - 03:32 27-09-2005 - 20:03
CVE-2016-2784 2.6
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a reques
09-10-2018 - 19:59 26-05-2016 - 14:59
CVE-2006-6844 6.8
Cross-site scripting (XSS) vulnerability in the optional user comment module in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the user comment form.
17-10-2018 - 21:49 31-12-2006 - 05:00
CVE-2006-6845 6.8
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the cntnt01searchinput parameter in a Search action.
17-10-2018 - 21:49 31-12-2006 - 05:00
CVE-2005-2392 4.3
Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function.
19-10-2018 - 15:32 27-07-2005 - 04:00
CVE-2007-5441 6.5
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.ph
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5442 3.5
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors.
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5443 4.3
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags.
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2007-5444 5.0
CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files.
15-10-2018 - 21:44 14-10-2007 - 18:17
CVE-2014-2092 4.3
Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE:
13-08-2015 - 18:23 02-03-2014 - 17:55
CVE-2013-3929 2.1
Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter.
10-12-2013 - 21:14 09-12-2013 - 16:55
CVE-2008-5642 5.0
Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie.
29-09-2017 - 01:32 17-12-2008 - 17:30
CVE-2011-3718 5.0
CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain othe
13-03-2012 - 04:00 23-09-2011 - 23:55
CVE-2017-16783 7.5
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.
01-12-2017 - 15:56 10-11-2017 - 23:29
CVE-2017-6555 3.5
Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka "Design Manager > Categories > Category Des
18-03-2017 - 01:59 09-03-2017 - 09:59
CVE-2017-6556 3.5
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage > sitesetting > General Settings > globalmetadata" field.
18-03-2017 - 01:59 09-03-2017 - 09:59
CVE-2017-7255 3.5
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack.
05-04-2017 - 01:59 24-03-2017 - 15:59
CVE-2017-7256 3.5
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack.
31-03-2017 - 01:59 24-03-2017 - 15:59
CVE-2017-7257 3.5
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack.
31-03-2017 - 01:59 24-03-2017 - 15:59
CVE-2017-8912 6.5
** DISPUTED ** CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor report
16-08-2017 - 01:29 12-05-2017 - 07:29
CVE-2017-9668 4.3
In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action.
22-06-2017 - 12:00 18-06-2017 - 21:29
CVE-2018-7448 8.5
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure.
22-03-2018 - 12:52 26-02-2018 - 17:29
CVE-2019-10017 3.5
CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
18-07-2019 - 16:27 24-03-2019 - 22:29
CVE-2019-10105 3.5
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager.
27-03-2019 - 12:29 26-03-2019 - 22:29
CVE-2019-10106 3.5
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.
27-03-2019 - 12:14 26-03-2019 - 22:29
CVE-2019-10107 3.5
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.
27-03-2019 - 12:27 26-03-2019 - 22:29
CVE-2019-11226 3.5
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
05-06-2019 - 20:47 05-06-2019 - 18:29
CVE-2019-17226 3.5
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
08-10-2019 - 14:06 06-10-2019 - 18:15
CVE-2019-17629 3.5
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
16-10-2019 - 19:11 16-10-2019 - 14:15
CVE-2019-17630 3.5
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
16-10-2019 - 19:09 16-10-2019 - 14:15
CVE-2020-10681 3.5
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
20-03-2020 - 04:15 20-03-2020 - 04:15
CVE-2020-10682 6.8
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a
20-03-2020 - 04:15 20-03-2020 - 04:15
CVE-2017-11404 4.0
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php.
03-10-2019 - 00:03 18-07-2017 - 00:29
CVE-2017-11405 4.0
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to t
03-10-2019 - 00:03 18-07-2017 - 00:29
CVE-2017-16784 4.3
In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter.
22-11-2017 - 17:25 10-11-2017 - 23:29
CVE-2017-16798 3.5
In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger
27-11-2017 - 13:56 12-11-2017 - 18:29
CVE-2018-1000092 6.8
CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via
10-04-2018 - 18:34 13-03-2018 - 15:29
CVE-2018-1000094 6.5
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via
19-03-2019 - 18:10 13-03-2018 - 01:29
CVE-2018-5963 3.5
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter.
07-02-2018 - 14:20 25-01-2018 - 16:29
CVE-2018-5964 3.5
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter.
07-02-2018 - 14:20 25-01-2018 - 16:29
CVE-2018-5965 3.5
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter.
07-02-2018 - 14:20 25-01-2018 - 16:29
CVE-2018-7893 3.5
CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
29-03-2018 - 12:05 12-03-2018 - 03:29
CVE-2018-8058 3.5
CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter.
29-03-2018 - 12:05 12-03-2018 - 03:29
CVE-2018-1000158 4.3
cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisonin
03-10-2019 - 00:03 18-04-2018 - 19:29
CVE-2018-10519 6.5
CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because files in the tmp/ directory are accessible through H
03-10-2019 - 00:03 27-04-2018 - 18:29
CVE-2018-18270 4.3
XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
28-11-2018 - 16:39 12-10-2018 - 19:29
CVE-2018-18271 4.3
XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
28-11-2018 - 14:30 12-10-2018 - 19:29
CVE-2018-9921 5.0
In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The atta
25-05-2018 - 14:35 23-04-2018 - 18:29
CVE-2018-19597 3.5
CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
26-02-2019 - 14:10 19-12-2018 - 19:29
CVE-2018-20464 4.3
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email addre
10-01-2019 - 20:56 25-12-2018 - 23:29
CVE-2019-9053 6.8
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
24-04-2019 - 18:58 26-03-2019 - 17:29
CVE-2019-9056 6.5
An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and ach
12-04-2019 - 11:20 11-04-2019 - 20:29
CVE-2007-0551 7.5
Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.
16-10-2018 - 16:33 29-01-2007 - 17:28
CVE-2007-0610 6.8
Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtai
29-07-2017 - 01:30 31-01-2007 - 01:28
Back to Top Mark selected
Back to Top