EUVD-2024-55318

CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensionsuserfiles and upload a shell script to the media directory to execute arbitrary code on the server...

CMSimple 5.15 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: CMSimple 5.15 - Remote Command Execution Date: 04/28/2024 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.cmsimple.org Software Link: https://www.cmsimple.org/downloadscmsimple50/CMSimple5-15.zip Version: latest Tested on: MacOS Log in to SimpleCMS. Go to Settings CM...

CVE-2024-32392

CVE-2024-32392 affects CmSimple v5.15 with a Cross-Site Scripting flaw in the functions.php component. The Red Hat, CNVD, CNNVD, CVE listings and PT-Security notes confirm a remote attacker could trigger arbitrary code execution via crafted input. Root cause cited as insufficient input filtering/...