CMSimple has a file inclusion vulnerability

CMSimple is a foreign open source simple content management system. CMSimple has a file inclusion vulnerability that can be exploited by attackers to gain server privileges...

CMSimple has a code execution vulnerability

CMSimple is a small PHP-based web content management tool. A code execution vulnerability exists in CMSimple that can be exploited by an attacker to execute arbitrary code...

Design/Logic Flaw

CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI...

CVE-2018-19507

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...

CVE-2018-19508

CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI...

CVE-2018-19507

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...

Design/Logic Flaw

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...

CVE-2018-19508

CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI...

CVE-2018-19508

CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI...

CVE-2018-19508

CMSimple 4.7.5 is affected by an XSS vulnerability that can be triggered by an administrator uploading an SVG file via the URI ?userfiles&subdir=userfiles/images/flags/. The issue is described as a cross-site scripting flaw introduced through SVG handling during admin file upload. The connected s...

CVE-2018-19507

CMSimple 4.7.5 is affected by a stored/reflected XSS issue triggered by an admin request using the URI parameter ?file=config&action=array. The NVD entry indicates the vulnerability exists in the web application’s handling of user-supplied input, enabling HTML/script injection that can potentiall...

CVE-2018-19507

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...

CVE-2018-19508: Improper Neutralization of Input During Web Page Generation

CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI...

CVE-2018-19507: Improper Neutralization of Input During Web Page Generation

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...

PT-2018-14978

Name of the Vulnerable Software and Affected Versions CMSimple version 4.7.5 Description The issue allows for XSS via an admin's use of a "?file=config&action=array" URI. Recommendations For CMSimple version 4.7.5, update to a version that fixes this issue, as using the ?file=config&action=array...

PT-2018-14979

Name of the Vulnerable Software and Affected Versions CMSimple version 4.7.5 Description The issue allows for XSS via an admin's upload of an SVG file at a "?userfiles&subdir=userfiles/images/flags/" URI. Recommendations For CMSimple version 4.7.5, consider restricting access to the upload...

CMSimple 4.6.2 Cross Site Scripting

============================================= MGC ALERT 2016-004 - Original release date: May 28, 2016 - Last revised: June 1, 2016 - Discovered by: Manuel Garcia Cardenas - Severity: 4,8/10 CVSS Base Score ============================================= I. VULNERABILITY -------------------------...

CMSimple CMS: source code security analysis report

Several vulnerabilities were discovered in CMSimple 'CMSimple CMS' software: File System Path Manipulation Incorrect User Input Filtration when Using Regular Expressions while Calling the pregreplace Function Using Global Variables Using Insufficiently Random Generators in Cryptography HttpOnly...

CMSimple 4.4.4 RFI / Code Execution / Default Password

Exploit Title : CMSimple 4.4.4 various security vulnerability Author : Govind Singh aka NullPort Vendor : http://cmsimple.org/ Download Link : http://www.cmsimple.org/downloadcounter/dlcount/count.php?id=31 Date : 26/07/2014 Discovered at : IHT Lab 1ND14N H4X0R5 T34M Love to : Manish Tanwar,...

CMSimple 4.4.4 - color Remote Code Execution

CMSimple 4.4.4 - color Remote Code Execution source: https://www.securityfocus.com/bid/68961/info CMSimple is prone to multiple security vulnerabilities including: 1. Multiple arbitrary PHP code-execution vulnerabilities 2. A weak authentication security-bypass vulnerability 3. Multiple security...