Information disclosure

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin...

Code injection

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrpformaformtemplate parameter in adminstoreform...

CVE-2017-6070

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrpformaformtemplate parameter in adminstoreform...

CVE-2017-6072

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin...

CVE-2017-6071

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml...

CVE-2017-6070

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrpformaformtemplate parameter in adminstoreform...

Information disclosure

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml...

CVE-2017-6072

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin...

CVE-2017-6071

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml...

CVE-2017-6071

The CVE-2017-6071 entry applies to CMS Made Simple Form Builder (CMSMS Form Builder) in CMS Made Simple v1.x prior to 0.8.1.6. The vulnerability is an information-disclosure flaw exploitable via exportxml, allowing remote attackers to access sensitive information. The available documents describe...

CVE-2017-6070

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrpformaformtemplate parameter in adminstoreform...

CVE-2017-6070

CMS Made Simple’s Form Builder (version 1.x) is affected up to 0.8.1.5, with a remote PHP code execution vulnerability exploitable via the cntnt01fbrp_forma_form_template parameter in admin_store_form. The root cause is improper handling of that parameter, enabling arbitrary code execution on the...

CVE-2017-6071

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml...

CVE-2017-6072

CMS Made Simple Form Builder (CMSMS) for CMS Made Simple version 1.x is affected by CVE-2017-6072, with exploitation allowing information disclosure via defaultadmin prior to version 0.8.1.6. The root cause is an information-disclosure vulnerability in the Form Builder module that enables remote ...

CVE-2017-6072

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin...

CMS Made Simple Cross-Site Request Forgery Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site request forgery vulnerability exists ...

CVE-2016-7904

Cross-site request forgery CSRF vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request...

CVE-2016-7904

Cross-site request forgery CSRF vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request...

CVE-2016-7904

CMS Made Simple CVE-2016-7904 is a CSRF in admin/adduser.php that lets an attacker hijack admin authentication to create accounts on versions before 2.1.6. Impact includes unauthorized admin account creation; remediation is to upgrade to 2.1.6 or newer.