Cross site scripting

In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter...

CVE-2017-16784

In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter...

CVE-2017-16783

CMS Made Simple 2.1.6 is affected by CVE-2017-16783: a Server-Side Template Injection issue exploited via the cntnt01detailtemplate parameter. Public references (NVD and exploit databases) describe a high-severity vulnerability with authenticated-free, network-exposed exploitation and impact to c...

CVE-2017-16783

In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter...

CVE-2017-16784

In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter...

CVE-2017-16784

CMS Made Simple 2.2.2 is affected by a Reflected XSS flaw exploitable via the cntnt01detailtemplate parameter. The vulnerability is described as Reflected XSS in multiple sources, with CVSS scores indicating a Medium impact (CVSSv3 base 6.1; CVSSv2 base 4.3). The connected documents confirm the v...

CMS Made Simple <= 2.2.2 Upload Vulnerability

CMS Made Simple is prone to an upload vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:cmsmadesimple:cmsmadesimple"...

Cross-site Request Forgery (CSRF)

CMS Made Simple is vulnerable to cross-site request forgery CSRF attacks. A malicious user can hijack the authentication of admins for requests to create accounts through an admin/adduser.php requests...

Design/Logic Flaw

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file...

Design/Logic Flaw

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

CVE-2017-11404

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

CVE-2017-11404

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

CVE-2017-11405

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file...

CVE-2017-11405

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file...

CVE-2017-11404

CMS Made Simple (CMSMS) 2.2.2 is affected by a vulnerability where remote authenticated administrators can upload a .php file through a FileManager action to admin/moduleinterface.php. The issue is documented across multiple feeds (NVD and others) with an attack surface requiring authentication, ...

CVE-2017-11405

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file...

CVE-2017-11404

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

CMS Made Simple Upload Vulnerability (CNVD-2017-24997)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMSMS version...

CVE-2017-11405

CMS Made Simple (CMSMS) 2.2.2 is affected by CVE-2017-11405. Remote authenticated administrators can abuse a sequence of actions (CMSContentManager to admin/moduleinterface.php, then a FilePicker action that changes type=image to type=file) to upload a PHP file. The exact vulnerability chain enab...

CMS Made Simple 2.2.1 Local File Inclusion

======= Details ======= Software:cmsmadesimple Homepage:http://www.cmsmadesimple.org/ version:=2.2.1 description:The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a "dynamic file inclusion" mechanisms implemented in the target application. The vulnerability...