EUVD-2011-4244

Malware in sbrugna...

CMSMS 2.2.19 Arbitrary File Upload

Title: cmsms-2.2.19 - File Upload - RCE Author: nu11secur1ty Date: 12/29/2023 Vendor: https://www.cmsmadesimple.org/ Software: https://www.cmsmadesimple.org/downloads-header/cmsms/ Reference: https://portswigger.net/web-security/file-upload,...

Remote Code Execution (RCE)

torfs-ict/cmsms is vulnerable to Remote Code Execution. The vulnerability exists because the library does not properly validate uploaded files, allowing an attacker to upload and execute a malicious file...

SQL Injection

torfs-ict/cmsms is vulnerable to SQL Injection attacks. The vulnerability exists in the m1sortby parameter in function.adminarticlestab.php due to improperly validated parameters, allowing a remote attacker to inject arbitrary SQL commands...

CVE-2022-29664

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/type/plsave...

CVE-2020-22732

CMS Made Simple (CMSMS) in version 2.2.14 is affected by a stored XSS vulnerability exploitable via the Extensions > Fie Picker. The issue is documented under CVE-2020-22732 across multiple sources (NVD, Red Hat, OpenVAS, etc.). Details in the connected documents confirm the affected product a...

CVE-2021-28935

CMS Made Simple (CMSMS) 2.2.15 is affected by an authenticated cross‑site scripting (XSS) vulnerability in /admin/addbookmark.php via Site Admin > My Preferences > Title field. The issue allows an authenticated user to inject scripts, with CVSS:3.1 base score 5.4 (MEDIUM) and CVSS2 base sco...

CVE-2020-20138

CMS Made Simple (CMSMS) Showtime2 Slideshow module in version 2.2.4 contains a Cross‑Site Scripting (XSS) vulnerability. The available documents confirm the affected component and version but do not provide details on the root cause, exploit vector, or specific impact in context beyond the XSS la...

CVE-2011-4310

The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles...

Code injection

The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles...

CVE-2011-4310

CVE-2011-4310 corresponds to a vulnerability in the News module of CMS Made Simple (CMSMS) prior to version 1.9.4.3. The issue allows remote attackers to corrupt newly written articles. Affected products: CMSMS, with the News module as the vulnerable component; vulnerable scope is versions earlie...

CVE-2011-4310

The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles...

CVE-2011-4310: Improper Input Validation

The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles...

CVE-2019-17630

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News Add Article" screen...

CVE-2019-17629

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

CVE-2019-17629

CMS Made Simple (CMSMS) 2.2.11 is affected by a stored cross‑site scripting (XSS) flaw. An admin can inject malicious content via a crafted image filename in the file manager > upload images screen, which is stored and later rendered in the application. The root cause is not explicitly detaile...

CVE-2019-17630

CMS Made Simple (CMSMS) version 2.2.11 contains a stored XSS vulnerability that can be triggered by an admin submitting a crafted image filename on the News > Add Article screen. The issue appears to be tied to how image filenames are processed and stored, enabling script execution in the admi...

CVE-2019-17629: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...

CVE-2019-17630: Improper Neutralization of Input During Web Page Generation

CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News Add Article" screen...

CVE-2019-17226

Summary: CVE-2019-17226 affects CMS Made Simple (CMSMS) 2.2.11, enabling cross-site scripting via the Site Admin > Module Manager > Search Term field. The vulnerability is evidenced in multiple sources (NVD entry mirrors the description). Some open-source scanner data (OpenVAS) indicates a ...