CVE-2017-16799: Improper Neutralization of Input During Web Page Generation

In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882...

PT-2017-14569

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.3.1 Description The issue allows for stored XSS via the m1 name parameter to "admin/moduleinterface.php" during the addition of a category. Recommendations For CMS Made Simple version 2.2.3.1, avoid using the m1 nam...

Design/Logic Flaw

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file...

CVE-2017-11405: Unrestricted Upload of File with Dangerous Type

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file...

PT-2017-11986

Name of the Vulnerable Software and Affected Versions CMS Made Simple CMSMS version 2.2.2 Description The issue allows remote authenticated administrators to upload a .php file. This can be achieved by performing a CMSContentManager action to "admin/moduleinterface.php", followed by a FilePicker...

CVE-2017-11404: Unrestricted Upload of File with Dangerous Type

In CMS Made Simple CMSMS 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php...

PT-2017-11985

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.2 Description The issue allows remote authenticated administrators to upload a .php file via a FileManager action to "admin/moduleinterface.php". Recommendations For CMS Made Simple version 2.2.2, consider restricti...

CVE-2017-6555: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1description parameter aka "Design Manager Categories Category Description"...

CVE-2014-2245: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the News module in CMS Made Simple CMSMS before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third...

PT-2014-4581

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions prior to 1.11.10 Description A SQL injection issue exists in the News module, allowing remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands. This is achieved by manipulating th...