CVE-2019-17629: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

CVE-2019-17630: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News Add Article" screen...

CVE-2019-17226: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.11 allows XSS via the Site Admin Module Manager Search Term field...

CMS Made Simple (CMSMS) Showtime2 File Upload Remote Command Execution Exploit

This Metasploit module exploits a file upload vulnerability that allows for remote command execution in Showtime2 module versions 3.6.2 and below in CMS Made Simple CMSMS. An authenticated user with "Use Showtime2" privilege could exploit the vulnerability. The vulnerability exists in the Showtim...

CVE-2018-10523: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple CMSMS through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajaxgettemplates.php, /modules/DesignManager/action.ajaxgetstylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php...

CVE-2018-10519: Incorrect Permission Assignment for Critical Resource

CMS Made Simple CMSMS 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the effuid value within $COOKIE$this-loginkey to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because o...

CVE-2018-10086: Improper Control of Generation of Code

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CVE-2018-10085: Deserialization of Untrusted Data

CMS Made Simple CMSMS through 2.2.6 allows PHP object injection because of an unserialize call in the getdata function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files...

CVE-2018-10082: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple CMSMS through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or...

CVE-2018-8058: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter...

CVE-2018-7893: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter...

CVE-2018-5965: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.5 has XSS in admin/moduleinterface.php via the m1errors parameter...

CVE-2018-5964: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.5 has XSS in admin/moduleinterface.php via the m1messages parameter...

CVE-2017-17734: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple CMSMS before 2.2.5 does not properly cache login information in sessions...

CVE-2017-17735: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple CMSMS before 2.2.5 does not properly cache login information in cookies...

CVE-2017-8912: Improper Control of Generation of Code

CMS Made Simple CMSMS 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug...

CVE-2011-3718: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple CMSMS 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444...