Simple CMS

CVEs (146)

CVE	Vendor / Product	CVSS	EPSS	Published	Description
CVE-2020-36411	Simple CMS Simple CMS	—	0.00	Jul 2, 2021	A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the {page_image} tag:" or "Path for thumbnail field:" parameters under the "Content…
CVE-2020-36410	Simple CMS Simple CMS	—	0.00	Jul 2, 2021	A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module.
CVE-2020-36409	Simple CMS Simple CMS	—	0.00	Jul 2, 2021	A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Category" parameter under the "Categories" module.
CVE-2020-36408	Simple CMS Simple CMS	—	0.00	Jul 2, 2021	A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module.
CVE-2020-27377	Simple CMS Simple CMS	—	0.01	Jun 1, 2021	A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
CVE-2020-24860	Simple CMS Simple CMS	—	0.01	Oct 1, 2020	CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
CVE-2020-22842	Simple CMS Simple CMS	—	0.00	Sep 30, 2020	CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.
CVE-2020-17462	Simple CMS Simple CMS	—	0.01	Aug 14, 2020	CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.
CVE-2020-14926	Simple CMS Simple CMS	—	0.01	Jun 19, 2020	CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page.
CVE-2020-13660	Simple CMS Simple CMS	—	0.01	May 28, 2020	CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
CVE-2020-10682	Simple CMS Simple CMS	—	0.02	Mar 20, 2020	The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file).
CVE-2020-10681	Simple CMS Simple CMS	—	0.01	Mar 20, 2020	The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
CVE-2019-17629	Simple CMS Simple CMS	—	0.01	Oct 16, 2019	CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
CVE-2019-17630	Simple CMS Simple CMS	—	0.01	Oct 16, 2019	CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
CVE-2019-17226	Simple CMS Simple CMS	—	0.01	Oct 6, 2019	CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
CVE-2019-11226	Simple CMS Simple CMS	—	0.01	Jun 5, 2019	CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
CVE-2019-11513	Simple CMS Simple CMS	—	0.01	Apr 25, 2019	The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
CVE-2019-9056	Simple CMS Simple CMS	—	0.01	Apr 11, 2019	An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object…
CVE-2019-10107	Simple CMS Simple CMS	—	0.01	Mar 26, 2019	CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.
CVE-2019-10106	Simple CMS Simple CMS	—	0.01	Mar 26, 2019	CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.

CVE-2020-36411Jul 2, 2021
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.00
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the {page_image} tag:" or "Path for thumbnail field:" parameters under the "Content…
CVE-2020-36410Jul 2, 2021
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.00
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module.
CVE-2020-36409Jul 2, 2021
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.00
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Category" parameter under the "Categories" module.
CVE-2020-36408Jul 2, 2021
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.00
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module.
CVE-2020-27377Jun 1, 2021
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
CVE-2020-24860Oct 1, 2020
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
CVE-2020-22842Sep 30, 2020
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.00
CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.
CVE-2020-17462Aug 14, 2020
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.
CVE-2020-14926Jun 19, 2020
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page.
CVE-2020-13660May 28, 2020
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
CVE-2020-10682Mar 20, 2020
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.02
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file).
CVE-2020-10681Mar 20, 2020
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
CVE-2019-17629Oct 16, 2019
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
CVE-2019-17630Oct 16, 2019
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
CVE-2019-17226Oct 6, 2019
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
CVE-2019-11226Jun 5, 2019
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
CVE-2019-11513Apr 25, 2019
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
CVE-2019-9056Apr 11, 2019
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object…
CVE-2019-10107Mar 26, 2019
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.
CVE-2019-10106Mar 26, 2019
Simple CMS
Simple CMS
risk 0.00cvss —epss 0.01
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.

Page 6 of 8