Total
132 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-36416 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-07-06 | 3.5 LOW | 5.4 MEDIUM |
| A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module. | |||||
| CVE-2020-27377 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-06-09 | 3.5 LOW | 4.8 MEDIUM |
| A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts. | |||||
| CVE-2021-28935 | 1 Cmsmadesimple | 1 Cms Made Simple | 2021-06-04 | 3.5 LOW | 5.4 MEDIUM |
| CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field. | |||||
| CVE-2020-20138 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-12-18 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4. | |||||
| CVE-2017-16783 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-11-10 | 7.5 HIGH | 9.8 CRITICAL |
| In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter. | |||||
| CVE-2020-24860 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-10-08 | 3.5 LOW | 5.4 MEDIUM |
| CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website. | |||||
| CVE-2020-22842 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-10-02 | 3.5 LOW | 5.4 MEDIUM |
| CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php. | |||||
| CVE-2019-9055 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-08-24 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection. | |||||
| CVE-2019-9056 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-08-24 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection. | |||||
| CVE-2018-10085 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-08-24 | 7.5 HIGH | 9.8 CRITICAL |
| CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files. | |||||
| CVE-2020-17462 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-08-19 | 6.5 MEDIUM | 7.8 HIGH |
| CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798. | |||||
| CVE-2020-14926 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-06-24 | 3.5 LOW | 5.4 MEDIUM |
| CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page. | |||||
| CVE-2020-13660 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-05-29 | 3.5 LOW | 4.8 MEDIUM |
| CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. | |||||
| CVE-2017-6071 | 1 Cmsmadesimple | 2 Cms Made Simple, Form Builder | 2020-05-05 | 5.0 MEDIUM | 5.3 MEDIUM |
| CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml. | |||||
| CVE-2020-10681 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-03-25 | 3.5 LOW | 5.4 MEDIUM |
| The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php. | |||||
| CVE-2020-10682 | 1 Cmsmadesimple | 1 Cms Made Simple | 2020-03-24 | 6.8 MEDIUM | 7.8 HIGH |
| The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file). | |||||
| CVE-2011-4310 | 1 Cmsmadesimple | 1 Cms Made Simple | 2019-12-04 | 5.0 MEDIUM | 7.5 HIGH |
| The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. | |||||
| CVE-2017-16798 | 1 Cmsmadesimple | 1 Cms Made Simple | 2019-11-21 | 3.5 LOW | 5.4 MEDIUM |
| In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or .svg. | |||||
| CVE-2019-17629 | 1 Cmsmadesimple | 1 Cms Made Simple | 2019-10-16 | 3.5 LOW | 4.8 MEDIUM |
| CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. | |||||
| CVE-2019-17630 | 1 Cmsmadesimple | 1 Cms Made Simple | 2019-10-16 | 3.5 LOW | 4.8 MEDIUM |
| CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. | |||||