Critical severity9.8NVD Advisory· Published Feb 21, 2017· Updated May 13, 2026

CVE-2017-6070

Description

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.

Affected products

Cmsmadesimple/Cms Made Simple
cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*
Range: <=1.12.2
Cmsmadesimple/Form Builder
cpe:2.3:a:cmsmadesimple:form_builder:*:*:*:*:*:*:*:*
Range: <=0.8.1.5

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

daylight-it.com/security-advisory-dlcs0001.htmlnvdExploitThird Party Advisory
dev.cmsmadesimple.org/project/files/69nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000