PT-2018-9668

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions through 2.2.7 Description: The issue concerns an arbitrary file deletion vulnerability in the admin dashboard. This occurs via directory traversal sequences in the val parameter within a 'cmd=del' request. The...

CVE-2018-10083: Improper Limitation of a Pathname to a Restricted Directory

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...