CVE-2025-5153 CMS Made Simple Design Manager Module cross site scripting

A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Design Manager Module. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The...

CVE-2025-5153

CMS Made Simple 2.2.21 is affected by a cross-site scripting vulnerability in the Design Manager Module, caused by improper handling of the Description argument. Exploitation is possible remotely and details have been disclosed publicly. No patch/version fix is provided in the documents; several ...

PT-2025-22865 · Unknown · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.21 Description: A problematic issue has been found in the Design Manager Module of CMS Made Simple, affecting some unknown processing. The manipulation of the Description argument leads to cross-site scripting. Thi...

CMS Made Simple（CMSMS） 代码注入漏洞

CMS Made Simple CMSMS is an open source content management system CMS from Cmsms team. The system supports role-based permission management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A code injection vulnerability exists in CMS Made Simple...

CVE-2024-27623

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection SSTI. The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs...

CVE-2024-27622

A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result, authenticated users with...

CVE-2024-27625

CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting XSS. This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field...

CVE-2023-36970

A Cross-site scripting XSS vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function...

CVE-2023-36969

CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function...

CVE-2021-28935

CMS Made Simple CMSMS 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin My Preferences Title field...

CVE-2020-20138

Cross Site Scripting XSS vulnerability in the Showtime2 Slideshow module in CMS Made Simple CMSMS 2.2.4...

CVE-2020-27377

A cross-site scripting XSS vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts...

CVE-2020-22732

CMS Made Simple CMSMS 2.2.14 allows stored XSS via the Extensions Fie Picker...

CVE-2020-22842

CMS Made Simple before 2.2.15 allows XSS via the m1mod parameter in a ModuleManager localuninstall action to admin/moduleinterface.php...

CVE-2020-14926

CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page...

CVE-2020-23241

Cross Site Scripting XSS vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News Article" feature...

CVE-2020-23240

Cross Site Scripting XSS vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature...

CVE-2020-36415

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Stylesheet" parameter under the "Stylesheets" module...

CVE-2020-36413

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Exclude these IP addresses from the "Site Down" status" parameter under the "Maintenance Mode" module...

CVE-2020-36409

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Category" parameter under the "Categories" module...