Lucene search

K
CmsmadesimpleCms Made Simple*

57 matches found

CVE
CVE
added 2019/03/26 5:29 p.m.221 views

CVE-2019-9055

An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, ...

8.8CVSS8.7AI score0.27589EPSS
CVE
CVE
added 2020/05/28 7:15 p.m.88 views

CVE-2020-13660

CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.

4.8CVSS4.8AI score0.0031EPSS
CVE
CVE
added 2010/05/12 4:5 p.m.67 views

CVE-2010-1482

Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.

4.3CVSS5.6AI score0.00285EPSS
CVE
CVE
added 2019/03/11 6:29 p.m.66 views

CVE-2019-9692

class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).

6.5CVSS6.6AI score0.57271EPSS
CVE
CVE
added 2007/09/24 10:17 p.m.62 views

CVE-2007-5056

Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter.

6.8CVSS7.8AI score0.70254EPSS
CVE
CVE
added 2019/11/26 11:15 p.m.61 views

CVE-2011-4310

The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.

7.5CVSS7.5AI score0.00233EPSS
CVE
CVE
added 2018/04/27 6:29 p.m.61 views

CVE-2018-10517

In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.

7.2CVSS7.5AI score0.18534EPSS
CVE
CVE
added 2008/01/04 11:46 a.m.59 views

CVE-2007-6656

SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.

7.5CVSS8.4AI score0.00874EPSS
CVE
CVE
added 2024/03/12 4:15 p.m.59 views

CVE-2024-1529

Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/adduser.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payl...

7.4CVSS6.6AI score0.00059EPSS
CVE
CVE
added 2022/06/09 3:15 p.m.58 views

CVE-2021-40961

CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.

8.8CVSS9AI score0.00347EPSS
CVE
CVE
added 2014/03/02 5:55 p.m.53 views

CVE-2014-0334

Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookm...

3.5CVSS5.3AI score0.00583EPSS
CVE
CVE
added 2018/01/02 5:29 p.m.50 views

CVE-2017-1000454

CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1

7.8CVSS7.5AI score0.00176EPSS
CVE
CVE
added 2019/04/25 3:29 a.m.49 views

CVE-2019-11513

The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.

4.8CVSS4.9AI score0.00288EPSS
CVE
CVE
added 2018/04/27 6:29 p.m.48 views

CVE-2018-10522

In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.

4.9CVSS5AI score0.00285EPSS
CVE
CVE
added 2017/02/21 7:59 a.m.47 views

CVE-2017-6072

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.

5.3CVSS5.4AI score0.00244EPSS
CVE
CVE
added 2017/02/21 7:59 a.m.46 views

CVE-2017-6071

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.

5.3CVSS5.4AI score0.00312EPSS
CVE
CVE
added 2019/03/26 5:29 p.m.46 views

CVE-2019-9057

An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.

8.8CVSS8.7AI score0.00781EPSS
CVE
CVE
added 2010/10/08 9:0 p.m.45 views

CVE-2010-2797

Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vuln...

7.5CVSS7.1AI score0.06404EPSS
CVE
CVE
added 2017/12/18 6:29 a.m.44 views

CVE-2017-17735

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.

9.8CVSS9.2AI score0.00275EPSS
CVE
CVE
added 2018/04/27 6:29 p.m.44 views

CVE-2018-10515

In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive.

7.2CVSS7.4AI score0.02743EPSS
CVE
CVE
added 2019/03/26 5:29 p.m.44 views

CVE-2019-9061

An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.

8.8CVSS8.6AI score0.00781EPSS
CVE
CVE
added 2018/01/02 5:29 p.m.43 views

CVE-2017-1000453

CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.

9.8CVSS9.8AI score0.00979EPSS
CVE
CVE
added 2017/12/18 6:29 a.m.43 views

CVE-2017-17734

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.

9.8CVSS9.2AI score0.00275EPSS
CVE
CVE
added 2017/02/21 7:59 a.m.41 views

CVE-2017-6070

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.

9.8CVSS9.6AI score0.00799EPSS
CVE
CVE
added 2018/04/27 6:29 p.m.41 views

CVE-2018-10516

In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory.

6.5CVSS6.2AI score0.00428EPSS
CVE
CVE
added 2010/10/08 9:0 p.m.40 views

CVE-2010-3884

Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from ...

6.8CVSS7.1AI score0.00079EPSS
CVE
CVE
added 2018/04/13 5:29 a.m.40 views

CVE-2018-10082

CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task....

5.3CVSS5.1AI score0.00289EPSS
CVE
CVE
added 2018/04/27 6:29 p.m.40 views

CVE-2018-10521

In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.

4CVSS4.3AI score0.00284EPSS
CVE
CVE
added 2018/04/27 6:29 p.m.40 views

CVE-2018-10523

CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php.

5.3CVSS5.1AI score0.00477EPSS
CVE
CVE
added 2023/05/08 2:15 p.m.40 views

CVE-2021-28999

SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php.

8.8CVSS9.3AI score0.00188EPSS
CVE
CVE
added 2011/06/08 10:36 a.m.39 views

CVE-2010-4663

Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.

10CVSS6.7AI score0.00414EPSS
CVE
CVE
added 2018/04/11 7:29 p.m.39 views

CVE-2018-10032

CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.

4.8CVSS4.9AI score0.00215EPSS
CVE
CVE
added 2018/04/13 5:29 a.m.39 views

CVE-2018-10084

CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed.

8.8CVSS8.8AI score0.00171EPSS
CVE
CVE
added 2018/04/13 5:29 a.m.39 views

CVE-2018-10085

CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files.

9.8CVSS9.6AI score0.03022EPSS
CVE
CVE
added 2012/12/03 9:55 p.m.38 views

CVE-2012-5450

Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter.

6.8CVSS7.2AI score0.00275EPSS
CVE
CVE
added 2013/10/11 10:55 p.m.38 views

CVE-2013-4167

Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS5.8AI score0.00285EPSS
CVE
CVE
added 2018/04/13 5:29 a.m.38 views

CVE-2018-10083

CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter.

7.5CVSS7.6AI score0.0089EPSS
CVE
CVE
added 2018/04/27 6:29 p.m.38 views

CVE-2018-10520

In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.

8.5CVSS6.5AI score0.00207EPSS
CVE
CVE
added 2010/10/08 9:0 p.m.37 views

CVE-2010-3882

Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add Field Definition, or (7)...

4.3CVSS5.4AI score0.00263EPSS
CVE
CVE
added 2010/10/08 9:0 p.m.37 views

CVE-2010-3883

Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications.

6.8CVSS7.4AI score0.00087EPSS
CVE
CVE
added 2018/04/27 6:29 p.m.37 views

CVE-2018-10518

In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.

8.5CVSS6.5AI score0.00207EPSS
CVE
CVE
added 2019/03/11 6:29 p.m.37 views

CVE-2019-9693

In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (paramete...

8.8CVSS9AI score0.00357EPSS
CVE
CVE
added 2017/01/16 6:59 a.m.36 views

CVE-2016-7904

Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.

8CVSS8.1AI score0.00054EPSS
CVE
CVE
added 2019/03/26 5:29 p.m.36 views

CVE-2019-9059

An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature.

7.2CVSS7.6AI score0.04139EPSS
CVE
CVE
added 2007/05/02 11:19 p.m.35 views

CVE-2007-2473

SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.

7.5CVSS8.4AI score0.00911EPSS
CVE
CVE
added 2018/04/13 5:29 a.m.35 views

CVE-2018-10086

CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.

7.2CVSS7.3AI score0.01019EPSS
CVE
CVE
added 2018/04/11 7:29 p.m.34 views

CVE-2018-10029

CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.

4.8CVSS4.9AI score0.00215EPSS
CVE
CVE
added 2019/03/26 5:29 p.m.34 views

CVE-2019-9058

An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.

7.2CVSS7.3AI score0.01005EPSS
CVE
CVE
added 2012/12/03 9:55 p.m.33 views

CVE-2012-6064

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remo...

3.5CVSS6.4AI score0.00903EPSS
CVE
CVE
added 2014/03/05 4:37 p.m.33 views

CVE-2014-2245

SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third p...

6CVSS8.2AI score0.00316EPSS
Total number of security vulnerabilities57