CVE-2024-22714

Stupid Simple CMS

CVE-2024-22715

Summary (from provided records): Stupid Simple CMS

CVE-2024-27558

Stupid Simple CMS version 1.2.4 and earlier are vulnerable to a Cross-Site Scripting (XSS) flaw. The vulnerability specifically exists within the blog title field located in the settings. This type of vulnerability typically allows an attacker to inject malicious scripts into web pages viewed by ...

CVE-2024-27689

Stupid Simple CMS v1.2.4 is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists in the /update-article.php component, allowing an attacker to perform unauthorized actions. While the specific root cause is not detailed, the vulnerability impacts the integrity of articles within the...

CVE-2024-3202

CVE-2024-3202 affects codelyfe Stupid Simple CMS 1.2.4 Login Page. The issue is inadequate restriction of excessive authentication attempts (no rate limiting), enabling remote abuse. Exploitation is publicly disclosed; attack complexity is high per source data. No concrete patch/version fix detai...

CVE-2024-27559

Stupid Simple CMS v1.2.4 and earlier versions are vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists in the /save_settings.php component. An attacker could potentially perform unauthorized actions by tricking a logged-in user into visiting a malicious link. No specific remediatio...

CVE-2023-7040

CVE-2023-7040 affects codelyfe Stupid Simple CMS up to v1.2.4. The vulnerability is in /file-manager/rename.php where manipulation of the oldName argument enables path traversal to ../filedir. It can be exploited remotely and has public disclosure. The vulnerability is tracked as VDB-248689. Miti...

CVE-2023-7041

CVE-2023-7041 details a path traversal vulnerability in codelyfe Stupid Simple CMS

CVE-2023-6907

The CVE-2023-6907 entry concerns codelyfe Stupid Simple CMS (versions up to 1.2.4). The vulnerability affects the Deletion Interface’s file-manager delete.php, where manipulation of the file parameter leads to improper authentication. Public exploit details exist, indicating potential exploitatio...

CVE-2023-6901

CVE-2023-6901 affects codelyfe Stupid Simple CMS versions up to 1.2.3. The vulnerability lies in the HTTP POST Request Handler’s file /terminal/handle-command.php, where using the argument with input “whoami” enables an OS command injection. The issue is exploitable remotely and an exploit has be...

CVE-2023-6902

CVE-2023-6902 affects codelyfe Stupid Simple CMS up to version 1.2.4. The vulnerability resides in the file /file-manager/upload.php, where manipulation of the file parameter enables unrestricted file upload. The description indicates the exploit has been disclosed publicly, posing a risk of remo...