CVE-2014-2092

Cross-site scripting XSS vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that...

CMS Made Simple contains multiple cross-site scripting vulnerabilities

Overview CMS Made Simple contains multiple cross-site scripting vulnerabilities Description CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - CVE-2014-0334The files: cmsmadesimple/admin/addgroup.php on line 107 contains a post-authentication reflected XS...

CVE-2013-3929

Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...

CVE-2013-3929

Cross-site scripting XSS vulnerability in admin/editevent.php in CMS Made Simple CMSMS 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter...

CVE-2013-3929

CMS Made Simple (CMSMS) 1.11.9 includes an XSS vulnerability in admin/editevent.php where the handler parameter can be exploited by remote authenticated users with the true 【Modify Events】 permission to inject arbitrary web script or HTML. The connected sources confirm the affected file and condi...

CVE-2013-4167

Cross-site scripting XSS vulnerability in CMS Made Simple CMSMS before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in CMS Made Simple CMSMS before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4167

CMS Made Simple (CMSMS) before 1.11.7 contains a Cross-site scripting (XSS) vulnerability (CVE-2013-4167). The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The available records confirm the affected product and version range, but do not describe th...

CVE-2013-4167

Cross-site scripting XSS vulnerability in CMS Made Simple CMSMS before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-6064

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. dot dot in the deld parameter. NOTE: this can be leveraged using CSRF CVE-2012-5450 to allow remote...

CVE-2012-5450

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

Directory traversal

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. dot dot in the deld parameter. NOTE: this can be leveraged using CSRF CVE-2012-5450 to allow remote...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

CVE-2012-5450

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

CVE-2012-5450

CMS Made Simple (CMSMS) prior to 1.11.2.1 is affected by a CSRF vulnerability in lib/filemanager/imagemanager/images.php (deld parameter) that allows an authenticated administrator to delete arbitrary files. The issue is documented as CVE-2012-5450 and is linked to a related directory-traversal c...

CVE-2012-6064

CMS Made Simple (CMSMS) versions prior to 1.11.2.1 are affected by CVE-2012-6064 due to a directory traversal vulnerability in lib/filemanager/imagemanager/images.php. The flaw allows remote authenticated administrators to delete arbitrary files via a deld parameter, and can be leveraged with CSR...

CVE-2012-6064

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. dot dot in the deld parameter. NOTE: this can be leveraged using CSRF CVE-2012-5450 to allow remote...

Cross-Site Request Forgery (CSRF) in CMS Made Simple

Advisory ID: HTB23121 Product: CMS Made Simple Vendor: cmsmadesimple.org Vulnerable Versions: 1.11.2 and probably prior Tested Version: 1.11.2 Vendor Notification: October 17, 2012 Public Disclosure: November 7, 2012 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE Reference:...

CMS Made Simple 1.11.2 Cross Site Request Forgery

Advisory ID: HTB23121 Product: CMS Made Simple Vendor: cmsmadesimple.org Vulnerable Versions: 1.11.2 and probably prior Tested Version: 1.11.2 Vendor Notification: October 17, 2012 Public Disclosure: November 7, 2012 Vulnerability Type: Cross-Site Request Forgery CWE-352 CVE Reference:...