1250 matches found
CVE-2020-17462
CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798...
CMS Made Simple 2.2.14 Shell Upload
Exploit Title: CMS Made Simple 2.2.14 - Arbitrary File Upload Authenticated Google Dork: - Date: 2020-07-29 Exploit Author: Roel van Beurden Vendor Homepage: https://www.cmsmadesimple.org/ Software Link: http://s3.amazonaws.com/cmsms/downloads/14793/cmsms-2.2.14-install.zip Version: 2.2.14 Tested...
CMS Made Simple 2.2.14 - Authenticated Arbitrary File Upload
Exploit Title: CMS Made Simple 2.2.14 - Arbitrary File Upload Authenticated Google Dork: - Date: 2020-07-29 Exploit Author: Roel van Beurden Vendor Homepage: https://www.cmsmadesimple.org/ Software Link: http://s3.amazonaws.com/cmsms/downloads/14793/cmsms-2.2.14-install.zip Version: 2.2.14 Tested...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2020-60831)
CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS Made...
CVE-2020-14926
CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page...
CVE-2020-14926
CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page...
CVE-2020-14926
CMS Made Simple 2.2.14 is affected by an XSS vulnerability reachable via the Search Term parameter to admin/moduleinterface.php?mact=ModuleManager. The issue stems from inadequate validation of client-side data, per CNVD-2020-60831 and corroborated by multiple feeds. Impact is client-side code ex...
CVE-2020-14926
CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page...
CMS Made Simple <= 2.2.14 Multiple XSS Vulnerabilities
CMS Made Simple is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2020-31089)
CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS Made...
CVE-2020-13660
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name...
CVE-2020-13660
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name...
Cross site scripting
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name...
CVE-2020-13660
CVE-2020-13660 concerns CMS Made Simple up to version 2.2.14, where an XSS vulnerability exists in the File Picker profile name. The connected sources consistently describe a cross-site scripting issue stemming from insufficient input/validation handling in the web application, enabling crafted p...
CVE-2020-13660
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name...
CMS Made Simple <= 2.2.15 Multiple Vulnerabilities
CMS Made Simple is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-10682
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1files to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code it need not be a valid JPEG file...
CVE-2020-10682
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1files to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code it need not be a valid JPEG file...