Vendor CVEs

Cmsmadesimple

All CVEs

158 total · sorted by risk

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2017-6072	Cmsmadesimple Form Builder	Med	0.35	5.3	0.02	Feb 21, 2017	CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
CVE-2017-6071	Cmsmadesimple Form Builder	Med	0.35	5.3	0.02	Feb 21, 2017	CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.
CVE-2016-2784	Cmsmadesimple Cmsmadesimple	Med	0.34	4.7	0.02	May 26, 2016	CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
CVE-2018-10522	Cmsmadesimple Cmsmadesimple	Med	0.32	4.9	0.01	Apr 27, 2018	In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.
CVE-2017-11405	Cmsmadesimple Cmsmadesimple	Med	0.32	4.9	0.01	Jul 18, 2017	In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file.
CVE-2017-11404	Cmsmadesimple Cmsmadesimple	Med	0.32	4.9	0.01	Jul 18, 2017	In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php.
CVE-2024-27625	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.00	Mar 5, 2024	CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field.
CVE-2020-22732	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.00	Aug 5, 2021	CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..
CVE-2020-23241	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.00	Jul 26, 2021	Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
CVE-2020-23240	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.00	Jul 26, 2021	Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
CVE-2020-27377	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	Jun 1, 2021	A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
CVE-2020-13660	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	May 28, 2020	CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
CVE-2019-17630	Cmsmadesimple Cmsms	Med	0.31	4.8	0.01	Oct 16, 2019	CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
CVE-2019-17629	Cmsmadesimple Cmsms	Med	0.31	4.8	0.01	Oct 16, 2019	CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
CVE-2019-17226	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	Oct 6, 2019	CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
CVE-2019-11513	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	Apr 25, 2019	The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
CVE-2018-19597	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	Dec 19, 2018	CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
CVE-2018-10033	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	Apr 11, 2018	CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
CVE-2018-10032	Cmsmadesimple Cmsms	Med	0.31	4.8	0.01	Apr 11, 2018	CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
CVE-2018-10029	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	Apr 11, 2018	CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
CVE-2018-8058	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	Mar 12, 2018	CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter.
CVE-2018-7893	Cmsmadesimple Cmsms	Med	0.31	4.8	0.01	Mar 12, 2018	CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
CVE-2018-5965	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	Jan 25, 2018	CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter.
CVE-2018-5964	Cmsmadesimple Cmsms	Med	0.31	4.8	0.01	Jan 25, 2018	CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter.
CVE-2018-5963	Cmsmadesimple Cmsmadesimple	Med	0.31	4.8	0.01	Jan 25, 2018	CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter.
CVE-2025-5153	Cmsmadesimple Cmsmadesimple	Low	0.23	3.5	0.00	May 25, 2025	A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Design Manager Module. The manipulation of the argument Description leads to cross site scripting. The attack may be…
CVE-2018-10521	Cmsmadesimple Cmsmadesimple	Low	0.18	2.7	0.01	Apr 27, 2018	In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.
CVE-2007-5056	Adodb Lite Adodb Lite		0.05	—	0.28	Sep 24, 2007	Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module…
CVE-2008-5642	Cmsmadesimple Cmsmadesimple		0.04	—	0.09	Dec 17, 2008	Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie.
CVE-2005-2846	Cmsmadesimple Cmsmadesimple		0.04	—	0.07	Sep 8, 2005	PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter.
CVE-2014-0334	Cmsmadesimple Cmsmadesimple		0.03	—	0.02	Mar 2, 2014	Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url…
CVE-2010-3884	Cmsmadesimple Cmsmadesimple		0.03	—	0.01	Oct 8, 2010	Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are…
CVE-2008-2267	Cmsmadesimple FileManager		0.03	—	0.05	May 16, 2008	Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6)…
CVE-2007-6656	Cmsmadesimple Cmsmadesimple		0.03	—	0.01	Jan 4, 2008	SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
CVE-2007-2473	Cmsmadesimple Cmsmadesimple		0.03	—	0.04	May 2, 2007	SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
CVE-2006-6845	Cmsmadesimple Cmsmadesimple		0.03	—	0.02	Dec 31, 2006	Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the cntnt01searchinput parameter in a Search action.
CVE-2005-3083	Cmsmadesimple Cmsmadesimple		0.03	—	0.01	Sep 27, 2005	Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVE-2010-2797	Cmsmadesimple Cmsmadesimple		0.01	—	0.08	Oct 8, 2010	Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by…
CVE-2014-2245	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Mar 5, 2014	SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are…
CVE-2014-2092	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Mar 2, 2014	Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also…
CVE-2013-3929	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Dec 9, 2013	Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter.
CVE-2013-4167	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Oct 11, 2013	Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-6064	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Dec 3, 2012	Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF…
CVE-2012-5450	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Dec 3, 2012	Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter.
CVE-2012-1992	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Apr 11, 2012	Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).
CVE-2011-3718	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Sep 23, 2011	CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might…
CVE-2010-4663	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Jun 8, 2011	Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.
CVE-2010-3883	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Oct 8, 2010	Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications.
CVE-2010-3882	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	Oct 8, 2010	Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add…
CVE-2010-1482	Cmsmadesimple Cmsmadesimple		0.00	—	0.01	May 12, 2010	Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.

CVE-2017-6072MedFeb 21, 2017
Cmsmadesimple
Form Builder
risk 0.35cvss 5.3epss 0.02
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
CVE-2017-6071MedFeb 21, 2017
Cmsmadesimple
Form Builder
risk 0.35cvss 5.3epss 0.02
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.
CVE-2016-2784MedMay 26, 2016
Cmsmadesimple
Cmsmadesimple
risk 0.34cvss 4.7epss 0.02
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
CVE-2018-10522MedApr 27, 2018
Cmsmadesimple
Cmsmadesimple
risk 0.32cvss 4.9epss 0.01
In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.
CVE-2017-11405MedJul 18, 2017
Cmsmadesimple
Cmsmadesimple
risk 0.32cvss 4.9epss 0.01
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file.
CVE-2017-11404MedJul 18, 2017
Cmsmadesimple
Cmsmadesimple
risk 0.32cvss 4.9epss 0.01
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php.
CVE-2024-27625MedMar 5, 2024
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.00
CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field.
CVE-2020-22732MedAug 5, 2021
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.00
CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..
CVE-2020-23241MedJul 26, 2021
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.00
Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
CVE-2020-23240MedJul 26, 2021
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.00
Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
CVE-2020-27377MedJun 1, 2021
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
CVE-2020-13660MedMay 28, 2020
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
CVE-2019-17630MedOct 16, 2019
Cmsmadesimple
Cmsms
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
CVE-2019-17629MedOct 16, 2019
Cmsmadesimple
Cmsms
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
CVE-2019-17226MedOct 6, 2019
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
CVE-2019-11513MedApr 25, 2019
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
CVE-2018-19597MedDec 19, 2018
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
CVE-2018-10033MedApr 11, 2018
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
CVE-2018-10032MedApr 11, 2018
Cmsmadesimple
Cmsms
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
CVE-2018-10029MedApr 11, 2018
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
CVE-2018-8058MedMar 12, 2018
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter.
CVE-2018-7893MedMar 12, 2018
Cmsmadesimple
Cmsms
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
CVE-2018-5965MedJan 25, 2018
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter.
CVE-2018-5964MedJan 25, 2018
Cmsmadesimple
Cmsms
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter.
CVE-2018-5963MedJan 25, 2018
Cmsmadesimple
Cmsmadesimple
risk 0.31cvss 4.8epss 0.01
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter.
CVE-2025-5153LowMay 25, 2025
Cmsmadesimple
Cmsmadesimple
risk 0.23cvss 3.5epss 0.00
A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Design Manager Module. The manipulation of the argument Description leads to cross site scripting. The attack may be…
CVE-2018-10521LowApr 27, 2018
Cmsmadesimple
Cmsmadesimple
risk 0.18cvss 2.7epss 0.01
In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.
CVE-2007-5056Sep 24, 2007
Adodb Lite
Adodb Lite
risk 0.05cvss —epss 0.28
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module…
CVE-2008-5642Dec 17, 2008
Cmsmadesimple
Cmsmadesimple
risk 0.04cvss —epss 0.09
Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie.
CVE-2005-2846Sep 8, 2005
Cmsmadesimple
Cmsmadesimple
risk 0.04cvss —epss 0.07
PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter.
CVE-2014-0334Mar 2, 2014
Cmsmadesimple
Cmsmadesimple
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url…
CVE-2010-3884Oct 8, 2010
Cmsmadesimple
Cmsmadesimple
risk 0.03cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are…
CVE-2008-2267May 16, 2008
Cmsmadesimple
FileManager
risk 0.03cvss —epss 0.05
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6)…
CVE-2007-6656Jan 4, 2008
Cmsmadesimple
Cmsmadesimple
risk 0.03cvss —epss 0.01
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
CVE-2007-2473May 2, 2007
Cmsmadesimple
Cmsmadesimple
risk 0.03cvss —epss 0.04
SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
CVE-2006-6845Dec 31, 2006
Cmsmadesimple
Cmsmadesimple
risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the cntnt01searchinput parameter in a Search action.
CVE-2005-3083Sep 27, 2005
Cmsmadesimple
Cmsmadesimple
risk 0.03cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVE-2010-2797Oct 8, 2010
Cmsmadesimple
Cmsmadesimple
risk 0.01cvss —epss 0.08
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by…
CVE-2014-2245Mar 5, 2014
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are…
CVE-2014-2092Mar 2, 2014
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also…
CVE-2013-3929Dec 9, 2013
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter.
CVE-2013-4167Oct 11, 2013
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-6064Dec 3, 2012
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF…
CVE-2012-5450Dec 3, 2012
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter.
CVE-2012-1992Apr 11, 2012
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).
CVE-2011-3718Sep 23, 2011
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might…
CVE-2010-4663Jun 8, 2011
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.
CVE-2010-3883Oct 8, 2010
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications.
CVE-2010-3882Oct 8, 2010
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add…
CVE-2010-1482May 12, 2010
Cmsmadesimple
Cmsmadesimple
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.

Page 3 of 4