1250 matches found
CMS Made Simple 2.1.6 Cross Site Scripting / Template Injection Vulnerabilities
Exploit for php platform in category web applications Affected Software : CMS Made Simple Affected Versions: Tested on 2.1.6 Vendor Homepage : http://www.cmsmadesimple.org/ Vulnerability Type : Server-Side Template Injection Severity : Important Status : Fixed CVE-ID : CVE-2017-16783 CVSS Base...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2017-36501)
CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in the...
CMS Made Simple 2.2.2 Reflected XSS Vulnerability
CMS Made Simple is prone to a reflected cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CMS Made Simple 2.1.6 Template Injection Vulnerability
CMS Made Simple is prone to a template injection vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CMS Made Simple 2.2.3.1 Multiple Vulnerabilities
CMS Made Simple is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cmsmadesimple:cmsmadesimple...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2017-36506)
CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2017-36502)
CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...
Design/Logic Flaw
In CMS Made Simple 2.2.3.1, the isfileacceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by...
Design/Logic Flaw
In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882...
CVE-2017-16799
In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882...
CVE-2017-16798
In CMS Made Simple 2.2.3.1, the isfileacceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by...
CVE-2017-16799
In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882...
CVE-2017-16798
In CMS Made Simple 2.2.3.1, the isfileacceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by...
CVE-2017-16799
In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882...
CVE-2017-16798
CMS Made Simple 2.2.3.1 is vulnerable in is_file_acceptable() in modules/FileManager/action.upload.php, which only blocks file extensions containing the substring “php” and fails for other extensions (e.g., .phtml, .pht, .html, .svg). This can bypass access restrictions and enable XSS via uploade...
CVE-2017-16799
CMS Made Simple is affected by CVE-2017-16799: a stored XSS in the New category flow. The vulnerability is in CMSMS 2.2.3.1, specifically via the m1_name parameter passed to admin/moduleinterface.php during category creation (module/action.addcategory.php). The issue enables injection of script/H...
Sql injection
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter...
CVE-2017-16784
In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter...