CVE-2019-9692

CMS Made Simple Showtime2 contains a vulnerability in class.showtime2_image.php where a watermark image file is not validated for a standard extension (GIF/JPG/JPEG/PNG). This enables an authenticated attacker with Showtime2 privileges to upload crafted files, potentially leading to remote comman...

CVE-2007-5056

CVE-2007-5056 is an eval injection in adodb-perf-module.inc.php of ADOdb Lite

CVE-2011-4310

CVE-2011-4310 corresponds to a vulnerability in the News module of CMS Made Simple (CMSMS) prior to version 1.9.4.3. The issue allows remote attackers to corrupt newly written articles. Affected products: CMSMS, with the News module as the vulnerable component; vulnerable scope is versions earlie...

CVE-2014-0334

CMS Made Simple (1.11.x) has multiple XSS vulnerabilities (CVE-2014-0334) exploitable via many admin parameters (admin/addgroup.php, admin/addhtmlblob.php, admin/addbookmark.php, admin/copystylesheet.php, admin/copytemplate.php, admin/editbookmark.php, admin/listtemplates.php, admin/listcss.php, ...

CVE-2017-1000454

CVE-2017-1000454 affects CMS Made Simple versions 2.1.6, 2.2, and 2.2.1. Affected component: Smarty Template Injection in some core components. Impact: local file read prior to 2.2 and local file inclusion since 2.2.1. Documentation from multiple sources confirms vulnerability details; explicit r...

CVE-2017-17735

CMS Made Simple (CMSMS) versions before 2.2.5 have a vulnerability where login information is not properly cached in cookies. Root cause: improper handling of login data in cookies. Impact is described by CVSS as high for confidentiality and integrity, but the connected documents do not spell out...

CVE-2017-1000453

CMS Made Simple versions 2.1.6 and 2.2 are affected by a Smarty templating injection in some core modules, enabling unauthenticated PHP code execution. The vulnerability stems from core module handling of Smarty templates (root cause as described). Impact is unauthenticated code execution with po...

CVE-2017-17734

CMS Made Simple (CMSMS) before version 2.2.5 contains a vulnerability where login information is not properly cached in sessions. The issue affects CMSMS 2.2.4 and earlier. Impact is tied to session handling and could affect authentication state. The connected documents confirm the affected produ...

CVE-2019-9693

CMS Made Simple (CMSMS) vulnerability CVE-2019-9693 affects CMSMS up to version 2.2.10. An authenticated user can exploit a SQL Injection in class.showtime2_data.php via multiple functions (_updateshow with show_id, _inputshow with show_id, _Getshowinfo with show_id, _Getpictureinfo with picture_...

CVE-2020-22842

CMS Made Simple (CMSMS) before version 2.2.15 is affected by CVE-2020-22842 due to an XSS vulnerability in the ModuleManager local_uninstall action that processes the m1_mod parameter in admin/moduleinterface.php. The underlying issue is insufficient input validation of this parameter, allowing a...