Information disclosure

In CMS Made Simple CMSMS through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP filegetcontents function...

CVE-2018-10518

In CMS Made Simple CMSMS through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories...

CVE-2018-10521

In CMS Made Simple CMSMS through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory...

Arbitrary file deletion

In CMS Made Simple CMSMS through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories...

CVE-2018-10518

In CMS Made Simple CMSMS through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories...

CVE-2018-10515

In CMS Made Simple CMSMS through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive...

CVE-2018-10517

In CMS Made Simple CMSMS through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element...

CVE-2018-10515

In CMS Made Simple CMSMS through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive...

Directory traversal

In CMS Made Simple CMSMS through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory...

Remote code execution

In CMS Made Simple CMSMS through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive...

CVE-2018-10517

In CMS Made Simple CMSMS through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element...

Remote code execution

In CMS Made Simple CMSMS through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element...

Arbitrary file deletion

In CMS Made Simple CMSMS through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories...

CVE-2018-10521

In CMS Made Simple CMSMS through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory...

CVE-2018-10520

CMS Made Simple (CMSMS) up to version 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard’s module remove operation. The issue allows an admin user to delete files under the lib/ directories across all paths, leading to denial of service (DoS). The description from Red ...

CVE-2018-10518

CMS Made Simple (CMSMS)

CVE-2018-10516

CVE-2018-10516 affects CMS Made Simple (CMSMS) up to version 2.2.7. The vulnerability lies in the admin dashboard “file rename” operation, which can disclose sensitive information and cause a Denial of Service by moving the config.php file into the upload/ directory. The issue is exploitable by a...

CVE-2018-10521

CMS Made Simple (CMSMS) prior to version 2.2.7 contains an arbitrary file movement vulnerability in the admin dashboard’s “file move” operation. This issue can be exploited by an admin user to cause a denial of service by moving the config.php file into an incorrect directory. Root cause: the fil...

CVE-2018-10522

CMS Made Simple (CMSMS) up to version 2.2.7 contains an information-disclosure vulnerability in the admin dashboard’s file view operation. The issue arises because the PHP file_get_contents function is exposed without access restrictions, allowing ordinary users to read arbitrary files. The cited...

CVE-2018-10520

In CMS Made Simple CMSMS through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories...