Total
154 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-1529 | 1 Cmsmadesimple | 1 Cms Made Simple | 2025-07-11 | N/A | 6.1 MEDIUM |
| Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/adduser.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to an authenticated user and partially take over their browser session. | |||||
| CVE-2025-5153 | 1 Cmsmadesimple | 1 Cms Made Simple | 2025-06-03 | N/A | 4.8 MEDIUM |
| A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Design Manager Module. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2024-27623 | 1 Cmsmadesimple | 1 Cms Made Simple | 2025-03-28 | N/A | N/A |
| CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs. | |||||
| CVE-2024-27625 | 1 Cmsmadesimple | 1 Cms Made Simple | 2025-03-28 | N/A | N/A |
| CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field. | |||||
| CVE-2024-27622 | 1 Cmsmadesimple | 1 Cms Made Simple | 2025-03-28 | N/A | N/A |
| A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result, authenticated users with administrative privileges can inject and execute arbitrary PHP code. | |||||
| CVE-2024-1527 | 1 Cmsmadesimple | 1 Cms Made Simple | 2025-02-26 | N/A | 8.8 HIGH |
| Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell. | |||||
| CVE-2024-1528 | 1 Cmsmadesimple | 1 Cms Made Simple | 2025-02-26 | N/A | 6.1 MEDIUM |
| CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/moduleinterface.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session. | |||||
| CVE-2021-28999 | 1 Cmsmadesimple | 1 Cms Made Simple | 2025-01-29 | N/A | 8.8 HIGH |
| SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php. | |||||
| CVE-2021-28998 | 1 Cmsmadesimple | 1 Cms Made Simple | 2025-01-29 | N/A | 7.2 HIGH |
| File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file. | |||||
| CVE-2023-43352 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-09-12 | N/A | 7.8 HIGH |
| An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component. | |||||
| CVE-2017-8912 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | 6.5 MEDIUM | 7.2 HIGH |
| CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug. | |||||
| CVE-2017-7255 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-02-14 | 3.5 LOW | 5.4 MEDIUM |
| XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack. | |||||
| CVE-2017-7257 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-02-14 | 3.5 LOW | 5.4 MEDIUM |
| XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack. | |||||
| CVE-2017-7256 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-02-14 | 3.5 LOW | 5.4 MEDIUM |
| XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack. | |||||
| CVE-2023-43339 | 1 Cmsmadesimple | 1 Cms Made Simple | 2023-11-08 | N/A | 6.1 MEDIUM |
| Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name, DataBase User or Database Port components. | |||||
| CVE-2007-6656 | 1 Cmsmadesimple | 1 Cms Made Simple | 2023-11-07 | 7.5 HIGH | N/A |
| SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter. | |||||
| CVE-2005-2846 | 1 Cmsmadesimple | 1 Cms Made Simple | 2023-11-07 | 7.5 HIGH | N/A |
| PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter. | |||||
| CVE-2023-43872 | 1 Cmsmadesimple | 1 Cms Made Simple | 2023-10-30 | N/A | 5.4 MEDIUM |
| A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS). | |||||
| CVE-2023-43360 | 1 Cmsmadesimple | 1 Cms Made Simple | 2023-10-30 | N/A | 5.4 MEDIUM |
| Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component. | |||||
| CVE-2023-43359 | 1 Cmsmadesimple | 1 Cms Made Simple | 2023-10-30 | N/A | 5.4 MEDIUM |
| Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component. | |||||