CVE-2014-0334

Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via 1 the group parameter to admin/addgroup.php, 2 the htmlblob parameter to admin/addhtmlblob.php, the 3 title or 4 url parameter to admin/addbookmark.php,...

CVE-2014-2092

Cross-site scripting XSS vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via 1 the group parameter to admin/addgroup.php, 2 the htmlblob parameter to admin/addhtmlblob.php, the 3 title or 4 url parameter to admin/addbookmark.php,...

Cross site scripting

Cross-site scripting XSS vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that...

CVE-2014-0334

Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via 1 the group parameter to admin/addgroup.php, 2 the htmlblob parameter to admin/addhtmlblob.php, the 3 title or 4 url parameter to admin/addbookmark.php,...

CVE-2014-2092

CMS Made Simple 1.11.10 is affected by a cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php, exploitable via the action parameter. This CVE-2014-2092 entry describes an XSS issue distinct from CVE-2014-0334; connected sources also reference other CMS Made Sim...

CVE-2014-0334

CMS Made Simple (1.11.x) has multiple XSS vulnerabilities (CVE-2014-0334) exploitable via many admin parameters (admin/addgroup.php, admin/addhtmlblob.php, admin/addbookmark.php, admin/copystylesheet.php, admin/copytemplate.php, admin/editbookmark.php, admin/listtemplates.php, admin/listcss.php, ...

CVE-2014-2092

Cross-site scripting XSS vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that...

CMS Made Simple contains multiple cross-site scripting vulnerabilities

Overview CMS Made Simple contains multiple cross-site scripting vulnerabilities Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-0334The files: cmsmadesimple/admin/addgroup.php on line 107 contains a post-authentication reflected XS...

CVE-2013-3929

Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...

CVE-2013-3929

Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...

CVE-2013-3929

CMS Made Simple (CMSMS) 1.11.9 includes an XSS vulnerability in admin/editevent.php where the handler parameter can be exploited by remote authenticated users with the true 【Modify Events】 permission to inject arbitrary web script or HTML. The connected sources confirm the affected file and condi...

CVE-2013-4167

Cross-site scripting XSS vulnerability in CMS Made Simple CMSMS before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in CMS Made Simple CMSMS before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4167

Cross-site scripting XSS vulnerability in CMS Made Simple CMSMS before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4167

CMS Made Simple (CMSMS) before 1.11.7 contains a Cross-site scripting (XSS) vulnerability (CVE-2013-4167). The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The available records confirm the affected product and version range, but do not describe th...

CVE-2012-6064

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. dot dot in the deld parameter. NOTE: this can be leveraged using CSRF CVE-2012-5450 to allow remote...

CVE-2012-5450

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

Directory traversal

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. dot dot in the deld parameter. NOTE: this can be leveraged using CSRF CVE-2012-5450 to allow remote...