CVE-2018-10083: Improper Limitation of a Pathname to a Restricted Directory

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...

PT-2018-9670

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions through 2.2.6 Description: The issue allows PHP object injection due to an unserialize call in the get data function of libclassesinternalclass.LoginOperations.php. A remote attacker can upload and execute code or...

PT-2018-9666

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions through 2.2.6 Description: The issue arises from improper comparison of data values, which can be demonstrated by a hash beginning with the "0e" substring, leading to an admin password reset vulnerability...

PT-2018-9667

Name of the Vulnerable Software and Affected Versions: CMS Made Simple CMSMS versions prior to 2.2.8 Description: The issue allows physical path leakage through various means, including an invalid page value in the /index.php?page= parameter, a crafted URI starting with /index.php?mact=Search, or...

PT-2018-9669

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions through 2.2.6 Description: The issue allows for a privilege escalation from an ordinary user to an admin user. This is achieved by manipulating the eff uid value within $ COOKIE$this- loginkey to equal 1, effectively...

PT-2018-9671

Name of the Vulnerable Software and Affected Versions: CMS Made Simple CMSMS versions prior to 2.2.8 Description: The issue is related to an arbitrary code execution vulnerability in the admin dashboard. This vulnerability arises from the use of eval function, specifically with the string 'functi...

PT-2018-9668

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions through 2.2.7 Description: The issue concerns an arbitrary file deletion vulnerability in the admin dashboard. This occurs via directory traversal sequences in the val parameter within a 'cmd=del' request. The...

cve

Cms Made Simple Multiple Vulnerability General descripti...

CMS Made Simple admin/siteprefs.php stored cross-site scripting vulnerability

CMS Made Simple is a content management system developed using PHP, MySQL and Smarty template engine. A stored cross-site scripting vulnerability exists in admin/siteprefs.php in CMS Made Simple 2.2.7. The vulnerability can be exploited to conduct cross-site scripting attacks via the metadata...

CMS Made Simple admin/siteprefs.php Cross-Site Request Forgery Vulnerability

CMS Made Simple is a content management system developed using PHP, MySQL and Smarty template engine. A cross-site request forgery vulnerability exists in admin/siteprefs.php in CMS Made Simple 2.2.7. No detailed vulnerability details are provided at this time...

CMS Made Simple admin/moduleinterface.php Reflective Cross-Site Scripting Vulnerability

CMS Made Simple is a content management system developed using PHP, MySQL and Smarty template engine. A reflected cross-site scripting vulnerability exists in admin/moduleinterface.php in CMS Made Simple 2.2.7. An attacker can exploit this vulnerability via the m1name parameter to conduct a...

CMS Made Simple admin/moduleinterface.php Cross-Site Request Forgery Vulnerability

CMS Made Simple is a content management system developed using PHP, MySQL and Smarty template engine. A cross-site request forgery vulnerability exists in admin/moduleinterface.php in CMS Made Simple 2.2.7. No detailed vulnerability details are provided at this time...

Code execution vulnerability in cms made simple v2.2.7 backend

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A code execution vulnerability exists in the backe...

CVE-2018-10033

CMS Made Simple aka CMSMS 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter...

CVE-2018-10030

CMS Made Simple aka CMSMS 2.2.7 has CSRF in admin/siteprefs.php...

CVE-2018-10029

CMS Made Simple aka CMSMS 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799...

Cross site request forgery (csrf)

CMS Made Simple aka CMSMS 2.2.7 has CSRF in admin/moduleinterface.php...

Cross site scripting

CMS Made Simple aka CMSMS 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter...

Design/Logic Flaw

CMS Made Simple aka CMSMS 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799...

Cross site request forgery (csrf)

CMS Made Simple aka CMSMS 2.2.7 has CSRF in admin/siteprefs.php...