CVE-2022-23907

CMS Made Simple v2.2.15 is affected by a reflected XSS via the m1_fmmessage parameter. The vulnerability is documented across multiple sources (e.g., CVE-2022-23907) and is described as a reflected XSS that could cause client-side JavaScript execution. The linked Red Hat/CVE info corroborates the...

CVE-2022-23906

CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution RCE vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file...

CVE-2022-23906

CMS Made Simple 2.2.15 is reported to have a Remote Command Execution (RCE) vulnerability in the avatar upload function, exploitable via a crafted image file. The issue is documented across multiple sources (NVD, Red Hat, CVE lists) with CVSS vectors indicating high impact (C/H/I/H/A/H; CVSS3.1: ...

CMS Made Simple 跨站脚本漏洞

CMS Made Simple is a content management system CMS. The system supports a role-based permission management system, a wizard-based installation and update mechanism, an intelligent caching mechanism, etc. A cross-site scripting vulnerability exists in CMS Made Simple v2.2.15, which stems from the...

PT-2022-16325

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.15 Description The issue is related to a Remote Command Execution RCE vulnerability. This vulnerability can be exploited via the upload avatar function using a crafted image file. Recommendations For CMS Made Simple...

PT-2022-16326

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.15 Description A reflected cross-site scripting XSS issue was found, which can be exploited via the m1 fmmessage parameter. Recommendations For CMS Made Simple version 2.2.15, update to a version that fixes this iss...

CVE-2022-23907: Improper Neutralization of Input During Web Page Generation

CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting XSS vulnerability via the parameter m1fmmessage...

CVE-2022-23906: Unrestricted Upload of File with Dangerous Type

CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution RCE vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file...

made-in-green.eterna.de Cross Site Scripting vulnerability OBB-2383109

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Plugin Events Made Easy SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Events Made Easy. The vulnerability stems from the program not properly filtering and...

CVE-2021-25030

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL...

CVE-2021-25030

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL...

CVE-2021-25030

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL...

Sql injection

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL...

CVE-2021-25030

CVE-2021-25030 : The WordPress plugin Events Made Easy (before 2.2.36) fails to sanitize and escape the search_text parameter used in the eme_searchmail AJAX action, enabling SQL injection when called by any authenticated user (e.g., roles as low as a subscriber). The vulnerability stems from imp...

PT-2022-9587

Name of the Vulnerable Software and Affected Versions Events Made Easy WordPress plugin versions prior to 2.2.36 Description The issue concerns the Events Made Easy WordPress plugin, which does not properly sanitise and escape the search text parameter before using it in a SQL statement via the...

WordPress plugin Events Made Easy SQL注入漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Events Made Easy. The vulnerability stems from the program not properly filtering and...

CVE-2021-25030: Improper Neutralization of Special Elements used in an SQL Command

The Events Made Easy WordPress plugin before 2.2.36 does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL...

Events Made Easy < 2.2.36 - Subscriber+ SQL Injection

The plugin does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks PoC...

Events Made Easy < 2.2.36 - Subscriber+ SQL Injection

The plugin does not sanitise and escape the searchtext parameter before using it in a SQL statement via the emesearchmail AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber can call it and perform SQL injection attacks...