PT-2018-9937

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.8 Description: The issue concerns a remote code execution vulnerability in the "file unpack" operation within the admin dashboard. This vulnerability can be exploited by an admin user, as a .php file can ...

PT-2018-9943

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.8 Description: The issue concerns an arbitrary file movement vulnerability in the "file move" operation within the admin dashboard. This can lead to a denial-of-service DoS condition. The vulnerability is...

PT-2018-9942

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.8 Description: The issue concerns an arbitrary file deletion vulnerability in the "module remove" operation within the admin dashboard. This can lead to a denial-of-service DoS condition. An attacker, who...

CVE-2018-10517: Improper Control of Generation of Code

In CMS Made Simple CMSMS through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element...

CVE-2018-10520: Incorrect Permission Assignment for Critical Resource

In CMS Made Simple CMSMS through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories...

Blog Master Pro 1.0 - CSV Injection

Exploit Title: Blog Master Pro v1.0 - CSV Injection Date: 2018-04-23 Exploit Author: 8bitsec CVE: CVE-2018-10255 Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/blog-master-pro/21689781 Version: 1.0 Tested on: Kali Linux 2.0 | Mac OS 10.13 Release Date:...

Remote code execution

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

Arbitrary file deletion

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...

CVE-2018-10083

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...

CVE-2018-10086

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CVE-2018-10083

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...

CVE-2018-10086

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CVE-2018-10086

CMS Made Simple (CMSMS) up to version 2.2.7 has an arbitrary code execution vulnerability in the admin dashboard. The root cause is the use of eval('function testfunction'.rand()) which can bypass certain restrictions on these testfunction functions. Affected product: CMSMS. The issue is document...

CMS Made Simple Arbitrary Code Execution Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism , etc. admin dashboard is one of the administration panel . An...

CMS Made Simple Arbitrary File Deletion Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by CMSMS team. The system supports role-based permission management system , wizard-based installation and update mechanism , intelligent caching mechanism , etc. admin dashboard is one of the administration panel . A...

PT-2018-9671

Name of the Vulnerable Software and Affected Versions: CMS Made Simple CMSMS versions prior to 2.2.8 Description: The issue is related to an arbitrary code execution vulnerability in the admin dashboard. This vulnerability arises from the use of eval function, specifically with the string 'functi...

PT-2018-9668

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions through 2.2.7 Description: The issue concerns an arbitrary file deletion vulnerability in the admin dashboard. This occurs via directory traversal sequences in the val parameter within a 'cmd=del' request. The...

CVE-2018-10086: Improper Control of Generation of Code

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CVE-2017-17736

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard...

PT-2018-6559

Name of the Vulnerable Software and Affected Versions: Kentico versions 9.0 through 9.0.50 Kentico versions 10.0 through 10.0.47 Description: The issue allows remote attackers to obtain Global Administrator access. This can be achieved by visiting the "CMSInstall/install.aspx" endpoint and then...