CVE-2019-9693

CMS Made Simple (CMSMS) vulnerability CVE-2019-9693 affects CMSMS up to version 2.2.10. An authenticated user can exploit a SQL Injection in class.showtime2_data.php via multiple functions (_updateshow with show_id, _inputshow with show_id, _Getshowinfo with show_id, _Getpictureinfo with picture_...

CVE-2019-9693

In CMS Made Simple CMSMS before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2data.php via the functions updateshow parameter showid, inputshow parameter showid, Getshowinfo parameter showid, Getpictureinfo parameter pictureid, AdjustNameSeq parameter shownumber,...

CMS Made Simple (CMSMS) Showtime2 File Upload RCE

This module exploits a File Upload vulnerability that lead in a RCE in Showtime2 module use exploit/multi/http/cmsms/showtime2rce msf undefinedshowtime2rce show actions ...actions... msf undefinedshowtime2rce set ACTION msf undefinedshowtime2rce show options ...show and set options... msf...

CMS Made Simple (CMSMS) Showtime2 Post Auth Arbitrary File Upload Vulnerability

CMSMS’s Showtime2 module is vulnerable to an arbitrary file upload vulnerability. An authenticated attacker can exploit this by uploading a malicious payload, and gain remote code execution. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UTC reported: Background CMS Made Simple CMSMS i...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2019-03432)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...

CVE-2018-20464

There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address...

Cross site scripting

There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address...

CVE-2018-20464

There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address...

CVE-2018-20464

The CVE-2018-20464 entry affects CMS Made Simple 2.2.8 in the admin/myaccount.php module, with a reflected XSS vulnerability triggered when a user mailbox format is incorrect and the response echoes the previously entered email address. This is documented across multiple sources in the connected ...

CVE-2018-19597

CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798...

CVE-2018-19597

CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798...

CVE-2018-19597

CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798...

CVE-2018-19597

CMS Made Simple 2.2.8 is affected by CVE-2018-19597: an XSS vulnerability via an uploaded SVG document. This is a related issue to CVE-2017-16798. The NVD entry indicates the impact as Low (I), with Partial integrity and No availability impact, and a Network attack vector with Medium access compl...

CMS Made Simple Remote Code Execution (CVE-2018-10517)

A remote command execution vulnerability exists in CMS Made Simple 2.2.7. By uploading an XML Package that contain base64-encoded PHP code in a data element, an authenticated attacker with administrator privileges can exploit this vulnerability for execution of arbitrary code...

CMS Made Simple remote password reset (CVE-2018-10081)

A remote password reset vulnerability exists in CMS Made Simple. The vulnerability is due to improper validation of password reset requests...

CMS Made Simple 2.2.7 - (Authenticated) Remote Code Execution

Exploit Title: CMS Made Simple 2.2.7 - Remote Code Execution Date: 2018-11-04 Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://www.cmsmadesimple.org/ Software Link:...

CMS Made Simple 2.2.7 - (Authenticated) Remote Code Execution

CMS Made Simple 2.2.7 - Authenticated Remote Code Execution Exploit Title: CMS Made Simple 2.2.7 - Remote Code Execution Date: 2018-11-04 Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage:...

CMS Made Simple 2.2.7 Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: CMS Made Simple 2.2.7 - Remote Code Execution Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://www.cmsmadesimple.org/ Software Link:...

CMS Made Simple 2.2.7 Remote Code Execution

Exploit Title: CMS Made Simple 2.2.7 - Remote Code Execution Date: 04-11-2018 Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://www.cmsmadesimple.org/ Software Link:...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2018-21249)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...