Cmsmadesimple
Source repositories
CVEs (156)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2016-2784 | Med | 0.34 | 4.7 | 0.02 | May 26, 2016 | CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request. | ||
| CVE-2018-10522 | Med | 0.32 | 4.9 | 0.01 | Apr 27, 2018 | In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function. | ||
| CVE-2017-11405 | Med | 0.32 | 4.9 | 0.01 | Jul 18, 2017 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file. | ||
| CVE-2017-11404 | Med | 0.32 | 4.9 | 0.01 | Jul 18, 2017 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php. | ||
| CVE-2024-27625 | Med | 0.31 | 4.8 | 0.00 | Mar 5, 2024 | CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field. | ||
| CVE-2020-22732 | Med | 0.31 | 4.8 | 0.00 | Aug 5, 2021 | CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker.. | ||
| CVE-2020-23241 | Med | 0.31 | 4.8 | 0.00 | Jul 26, 2021 | Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature. | ||
| CVE-2020-23240 | Med | 0.31 | 4.8 | 0.00 | Jul 26, 2021 | Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature. | ||
| CVE-2020-27377 | Med | 0.31 | 4.8 | 0.01 | Jun 1, 2021 | A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts. | ||
| CVE-2020-13660 | Med | 0.31 | 4.8 | 0.01 | May 28, 2020 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. | ||
| CVE-2019-17630 | Med | 0.31 | 4.8 | 0.01 | Oct 16, 2019 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. | ||
| CVE-2019-17629 | Med | 0.31 | 4.8 | 0.01 | Oct 16, 2019 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. | ||
| CVE-2019-17226 | Med | 0.31 | 4.8 | 0.01 | Oct 6, 2019 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. | ||
| CVE-2019-11513 | Med | 0.31 | 4.8 | 0.01 | Apr 25, 2019 | The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. | ||
| CVE-2018-19597 | Med | 0.31 | 4.8 | 0.01 | Dec 19, 2018 | CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798. | ||
| CVE-2018-10033 | Med | 0.31 | 4.8 | 0.01 | Apr 11, 2018 | CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter. | ||
| CVE-2018-10032 | Med | 0.31 | 4.8 | 0.01 | Apr 11, 2018 | CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter. | ||
| CVE-2018-10029 | Med | 0.31 | 4.8 | 0.01 | Apr 11, 2018 | CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799. | ||
| CVE-2018-8058 | Med | 0.31 | 4.8 | 0.01 | Mar 12, 2018 | CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter. | ||
| CVE-2018-7893 | Med | 0.31 | 4.8 | 0.01 | Mar 12, 2018 | CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter. |
- risk 0.34cvss 4.7epss 0.02
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
- risk 0.32cvss 4.9epss 0.01
In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.
- risk 0.32cvss 4.9epss 0.01
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file.
- risk 0.32cvss 4.9epss 0.01
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php.
- risk 0.31cvss 4.8epss 0.00
CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field.
- risk 0.31cvss 4.8epss 0.00
CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..
- risk 0.31cvss 4.8epss 0.00
Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
- risk 0.31cvss 4.8epss 0.00
Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
- risk 0.31cvss 4.8epss 0.01
A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
- risk 0.31cvss 4.8epss 0.01
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter.
- risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
Page 6 of 8