1905 matches found
CVE-2019-9692
class.showtime2image.php in CMS Made Simple CMSMS before 2.2.10 does not ensure that a watermark file has a standard image file extension GIF, JPG, JPEG, or PNG...
CVE-2019-9693
In CMS Made Simple CMSMS before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2data.php via the functions updateshow parameter showid, inputshow parameter showid, Getshowinfo parameter showid, Getpictureinfo parameter pictureid, AdjustNameSeq parameter shownumber,...
CVE-2019-9693
In CMS Made Simple CMSMS before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2data.php via the functions updateshow parameter showid, inputshow parameter showid, Getshowinfo parameter showid, Getpictureinfo parameter pictureid, AdjustNameSeq parameter shownumber,...
CVE-2019-9693
CMS Made Simple (CMSMS) vulnerability CVE-2019-9693 affects CMSMS up to version 2.2.10. An authenticated user can exploit a SQL Injection in class.showtime2_data.php via multiple functions (_updateshow with show_id, _inputshow with show_id, _Getshowinfo with show_id, _Getpictureinfo with picture_...
CVE-2019-9692
CMS Made Simple Showtime2 contains a vulnerability in class.showtime2_image.php where a watermark image file is not validated for a standard extension (GIF/JPG/JPEG/PNG). This enables an authenticated attacker with Showtime2 privileges to upload crafted files, potentially leading to remote comman...
CVE-2019-9692
class.showtime2image.php in CMS Made Simple CMSMS before 2.2.10 does not ensure that a watermark file has a standard image file extension GIF, JPG, JPEG, or PNG...
CMS Made Simple (CMSMS) Showtime2 Post Auth Arbitrary File Upload Vulnerability
CMSMS’s Showtime2 module is vulnerable to an arbitrary file upload vulnerability. An authenticated attacker can exploit this by uploading a malicious payload, and gain remote code execution. Recent assessments: wchen-r7 at September 12, 2019 6:07pm UTC reported: Background CMS Made Simple CMSMS i...
PT-2019-19801
Name of the Vulnerable Software and Affected Versions CMS Made Simple versions prior to 2.2.10 Description The issue allows an authenticated user to achieve SQL Injection in the class.showtime2 data.php file via several functions, including updateshow, inputshow, Getshowinfo, Getpictureinfo,...
PT-2019-19800
Name of the Vulnerable Software and Affected Versions CMS Made Simple versions prior to 2.2.10 Description The issue concerns the class.showtime2 image.php file in CMS Made Simple, where it fails to verify that a watermark file has a standard image file extension, such as GIF, JPG, JPEG, or PNG...
CVE-2019-9692: Unrestricted Upload of File with Dangerous Type
class.showtime2image.php in CMS Made Simple CMSMS before 2.2.10 does not ensure that a watermark file has a standard image file extension GIF, JPG, JPEG, or PNG...
CVE-2019-9693: Improper Neutralization of Special Elements used in an SQL Command
In CMS Made Simple CMSMS before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2data.php via the functions updateshow parameter showid, inputshow parameter showid, Getshowinfo parameter showid, Getpictureinfo parameter pictureid, AdjustNameSeq parameter shownumber,...
CMS Made Simple (CMSMS) Showtime2 File Upload RCE
This module exploits a File Upload vulnerability that lead in a RCE in Showtime2 module use exploit/multi/http/cmsms/showtime2rce msf undefinedshowtime2rce show actions ...actions... msf undefinedshowtime2rce set ACTION msf undefinedshowtime2rce show options ...show and set options... msf...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2019-03432)
CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in the...
Cross site scripting
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address...
CVE-2018-20464
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address...
CVE-2018-20464
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address...
CVE-2018-20464
The CVE-2018-20464 entry affects CMS Made Simple 2.2.8 in the admin/myaccount.php module, with a reflected XSS vulnerability triggered when a user mailbox format is incorrect and the response echoes the previously entered email address. This is documented across multiple sources in the connected ...
CVE-2018-20464: Improper Neutralization of Input During Web Page Generation
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address...
PT-2018-15399
Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.8 Description The issue is related to a reflected XSS vulnerability. It occurs when attempting to modify a user's mailbox with an incorrect format in the admin/myaccount.php file. The response includes the user's...