CVE-2007-5444

CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files...

CVE-2007-5441

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by 1 adding a user via a direct request to admin/adduser.php and 2 reading the admin log via an...

CVE-2007-5442

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors...

Design/Logic Flaw

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors...

CVE-2007-5443

Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 the anchor tag and 2 listtags...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 the anchor tag and 2 listtags...

Path traversal

CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files...

CVE-2007-5441

CMS Made Simple 1.1.3.1 is affected by a permission-check bypass vulnerability. Remote authenticated users can perform some administrative actions, e.g., adding a user via admin/adduser.php and reading adminlog.php?page=1. Root cause: incomplete permission validation in certain request paths. No ...

CVE-2007-5443

CVE-2007-5443 describes multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1. The description specifies remote attackers can inject arbitrary script or HTML via vectors related to (1) the anchor tag and (2) listtags, but the exact technical vectors are not detailed in th...

CVE-2007-5444

CMS Made Simple 1.1.3.1 is vulnerable to a path-disclosure issue: remote attackers can obtain the server’s full path by directly requesting unspecified files. This is a remote, unauthenticated weakness with partial confidentiality impact. No explicit fix/version is stated in the provided document...

CVE-2007-5442

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors...

CVE-2007-5444

CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files...

CVE-2007-5441

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by 1 adding a user via a direct request to admin/adduser.php and 2 reading the admin log via an...

CVE-2007-5442

CVE-2007-5442 affects CMS Made Simple 1.1.3.1. The vulnerability is that the system does not check the permissions of users attempting uploads, allowing remote authenticated users to upload unspecified files via unknown vectors. The public description does not specify affected files, exploit meth...

CVE-2007-5443

Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 the anchor tag and 2 listtags...

CVE-2007-5442: Undefined Security Weakness

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors...

CVE-2007-5444: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files...

CVE-2007-5443: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to 1 the anchor tag and 2 listtags...

CVE-2007-5441: Undefined Security Weakness

CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by 1 adding a user via a direct request to admin/adduser.php and 2 reading the admin log via an...

Several vulnerabilities in CMS Made Simple 1.1.3.1

Hi, There are several security bugs in CMS Made Simple 1.1.3.1 : I am not going to release dangerous and exploitable info here 1 There is a highly dangerous PHP code execution bug in the script . 2 A registered user can access unauthorized pages . For example he can upload files to the server, or...