1250 matches found
CVE-2019-17630
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News Add Article" screen...
CVE-2019-17629
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...
CVE-2019-10107
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences - My Account" section...
CVE-2019-10105
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager...
CVE-2019-17226
CMS Made Simple CMSMS 2.2.11 allows XSS via the Site Admin Module Manager Search Term field...
CVE-2019-10106
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section...
CVE-2019-11513
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action...
CVE-2019-10017
CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker...
CVE-2018-10030
CMS Made Simple aka CMSMS 2.2.7 has CSRF in admin/siteprefs.php...
CVE-2018-10031
CMS Made Simple aka CMSMS 2.2.7 has CSRF in admin/moduleinterface.php...
CVE-2017-17735
CMS Made Simple CMSMS before 2.2.5 does not properly cache login information in cookies...
CVE-2018-10084
CMS Made Simple CMSMS through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the effuid value within $COOKIE$this-loginkey to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed...
CVE-2017-17734
CMS Made Simple CMSMS before 2.2.5 does not properly cache login information in sessions...
CVE-2018-10029
CMS Made Simple aka CMSMS 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799...
CVE-2017-11404
In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...
CVE-2013-4167
Cross-site scripting XSS vulnerability in CMS Made Simple CMSMS before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2010-3883
Cross-site request forgery CSRF vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications...
CVE-2010-3882
Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the 1 Add Pages, 2 Add Global Content, 3 Edit Global Content, 4 Add Article, 5 Add Category, 6 Add Field Definition, or 7 Add Shortcut...
CVE-2018-10515
In CMS Made Simple CMSMS through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive...