PT-2018-9943

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.8 Description: The issue concerns an arbitrary file movement vulnerability in the "file move" operation within the admin dashboard. This can lead to a denial-of-service DoS condition. The vulnerability is...

PT-2018-9942

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.8 Description: The issue concerns an arbitrary file deletion vulnerability in the "module remove" operation within the admin dashboard. This can lead to a denial-of-service DoS condition. An attacker, who...

PT-2018-9944

Name of the Vulnerable Software and Affected Versions: CMS Made Simple CMSMS versions prior to 2.2.8 Description: The issue concerns a sensitive information disclosure problem in the admin dashboard's "file view" operation. This is due to the product exposing unrestricted access to the PHP file g...

CVE-2018-10522: Exposure of Sensitive Information to an Unauthorized Actor

In CMS Made Simple CMSMS through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP filegetcontents function...

PT-2018-9937

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.8 Description: The issue concerns a remote code execution vulnerability in the "file unpack" operation within the admin dashboard. This vulnerability can be exploited by an admin user, as a .php file can ...

CVE-2018-10518: Incorrect Permission Assignment for Critical Resource

In CMS Made Simple CMSMS through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories...

CVE-2018-10521: Unrestricted Upload of File with Dangerous Type

In CMS Made Simple CMSMS through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory...

CVE-2018-10520: Incorrect Permission Assignment for Critical Resource

In CMS Made Simple CMSMS through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories...

PT-2018-9938

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.8 Description: The issue concerns a sensitive information disclosure vulnerability in the "file rename" operation within the admin dashboard. This vulnerability can be exploited by an admin user and may...

PT-2018-9939

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.8 Description: The issue concerns a remote code execution vulnerability in the "module import" operation within the admin dashboard. This vulnerability can be exploited by an admin user, as an XML Package...

Blog Master Pro 1.0 - CSV Injection

Exploit Title: Blog Master Pro v1.0 - CSV Injection Date: 2018-04-23 Exploit Author: 8bitsec CVE: CVE-2018-10255 Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/blog-master-pro/21689781 Version: 1.0 Tested on: Kali Linux 2.0 | Mac OS 10.13 Release Date:...

CVE-2018-10086

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CVE-2018-10083

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...

Arbitrary file deletion

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...

Remote code execution

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CVE-2018-10086

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CVE-2018-10083

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...

CVE-2018-10086

CMS Made Simple (CMSMS) up to version 2.2.7 has an arbitrary code execution vulnerability in the admin dashboard. The root cause is the use of eval('function testfunction'.rand()) which can bypass certain restrictions on these testfunction functions. Affected product: CMSMS. The issue is document...

CVE-2018-10086: Improper Control of Generation of Code

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CMS Made Simple Arbitrary Code Execution Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism , etc. admin dashboard is one of the administration panel . An...