Vulnerabilites related to cmsmadesimple - cms_made_simple
cve-2006-6845
Vulnerability from cvelistv5
Published
2007-01-03 02:00
Modified
2024-08-07 20:42
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the cntnt01searchinput parameter in a Search action.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/455417/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.vupen.com/english/advisories/2007/0027 | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/bid/21527 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/23582 | third-party-advisory, x_refsource_SECUNIA | |
| http://osvdb.org/32571 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:42:07.528Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20061228 Re: XSS - CMS Made Simple v1.0.2",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/455417/100/0/threaded"
},
{
"name": "ADV-2007-0027",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0027"
},
{
"name": "21527",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21527"
},
{
"name": "23582",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23582"
},
{
"name": "32571",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32571"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-12-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the cntnt01searchinput parameter in a Search action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20061228 Re: XSS - CMS Made Simple v1.0.2",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/455417/100/0/threaded"
},
{
"name": "ADV-2007-0027",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0027"
},
{
"name": "21527",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21527"
},
{
"name": "23582",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23582"
},
{
"name": "32571",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32571"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6845",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the cntnt01searchinput parameter in a Search action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20061228 Re: XSS - CMS Made Simple v1.0.2",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/455417/100/0/threaded"
},
{
"name": "ADV-2007-0027",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0027"
},
{
"name": "21527",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21527"
},
{
"name": "23582",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23582"
},
{
"name": "32571",
"refsource": "OSVDB",
"url": "http://osvdb.org/32571"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6845",
"datePublished": "2007-01-03T02:00:00",
"dateReserved": "2007-01-02T00:00:00",
"dateUpdated": "2024-08-07T20:42:07.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9055
Vulnerability from cvelistv5
Published
2019-03-26 16:25
Modified
2024-08-04 21:38
Severity ?
EPSS score ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:45.640Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/155322/CMS-Made-Simple-2.2.8-Remote-Code-Execution.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://blog.certimetergroup.com/it/articolo/security/CMS_Made_Simple_deserialization_attack_%28CVE-2019-9055%29"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-18T18:06:41",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/155322/CMS-Made-Simple-2.2.8-Remote-Code-Execution.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://blog.certimetergroup.com/it/articolo/security/CMS_Made_Simple_deserialization_attack_%28CVE-2019-9055%29"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9055",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"name": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg",
"refsource": "MISC",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"name": "http://packetstormsecurity.com/files/155322/CMS-Made-Simple-2.2.8-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/155322/CMS-Made-Simple-2.2.8-Remote-Code-Execution.html"
},
{
"name": "https://blog.certimetergroup.com/it/articolo/security/CMS_Made_Simple_deserialization_attack_%28CVE-2019-9055%29",
"refsource": "MISC",
"url": "https://blog.certimetergroup.com/it/articolo/security/CMS_Made_Simple_deserialization_attack_%28CVE-2019-9055%29"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9055",
"datePublished": "2019-03-26T16:25:59",
"dateReserved": "2019-02-23T00:00:00",
"dateUpdated": "2024-08-04T21:38:45.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10086
Vulnerability from cvelistv5
Published
2018-04-13 05:00
Modified
2024-09-16 19:05
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:01.156Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses \"eval(\u0027function testfunction\u0027.rand()\" and it is possible to bypass certain restrictions on these \"testfunction\" functions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-13T05:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10086",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses \"eval(\u0027function testfunction\u0027.rand()\" and it is possible to bypass certain restrictions on these \"testfunction\" functions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10086",
"datePublished": "2018-04-13T05:00:00Z",
"dateReserved": "2018-04-13T00:00:00Z",
"dateUpdated": "2024-09-16T19:05:45.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-5964
Vulnerability from cvelistv5
Published
2018-01-25 16:00
Modified
2024-08-05 05:47
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/ | x_refsource_MISC | |
| http://seclists.org/fulldisclosure/2018/Jan/82 | mailing-list, x_refsource_FULLDISC | |
| http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T05:47:56.170Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
},
{
"name": "20180123 CMS Made Simple 2.2.5[Reflected Cross-Site Scripting]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/82"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-01-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-25T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
},
{
"name": "20180123 CMS Made Simple 2.2.5[Reflected Cross-Site Scripting]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/82"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-5964",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/",
"refsource": "MISC",
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
},
{
"name": "20180123 CMS Made Simple 2.2.5[Reflected Cross-Site Scripting]",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2018/Jan/82"
},
{
"name": "http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-5964",
"datePublished": "2018-01-25T16:00:00",
"dateReserved": "2018-01-21T00:00:00",
"dateUpdated": "2024-08-05T05:47:56.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-13660
Vulnerability from cvelistv5
Published
2020-05-28 18:53
Modified
2024-08-04 12:25
Severity ?
EPSS score ?
Summary
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12312 | x_refsource_MISC | |
| https://www.youtube.com/watch?v=Q6RMhmpScho | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:25:16.166Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12312"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.youtube.com/watch?v=Q6RMhmpScho"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-05-28T18:53:25",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12312"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.youtube.com/watch?v=Q6RMhmpScho"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-13660",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12312",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12312"
},
{
"name": "https://www.youtube.com/watch?v=Q6RMhmpScho",
"refsource": "MISC",
"url": "https://www.youtube.com/watch?v=Q6RMhmpScho"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-13660",
"datePublished": "2020-05-28T18:53:25",
"dateReserved": "2020-05-28T00:00:00",
"dateUpdated": "2024-08-04T12:25:16.166Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-22732
Vulnerability from cvelistv5
Published
2021-08-05 16:24
Modified
2024-08-04 14:51
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12288 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:51:10.828Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12288"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions \u003e Fie Picker.."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-05T16:24:14",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12288"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-22732",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions \u003e Fie Picker.."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12288",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12288"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-22732",
"datePublished": "2021-08-05T16:24:14",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:51:10.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-16784
Vulnerability from cvelistv5
Published
2017-11-10 23:00
Modified
2024-08-05 20:35
Severity ?
EPSS score ?
Summary
In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:35:21.023Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-031-reflected-xss-vulnerability-in-cms-made-simple/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-11-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-10T23:57:02",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-031-reflected-xss-vulnerability-in-cms-made-simple/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-16784",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.netsparker.com/web-applications-advisories/ns-17-031-reflected-xss-vulnerability-in-cms-made-simple/",
"refsource": "MISC",
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-031-reflected-xss-vulnerability-in-cms-made-simple/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-16784",
"datePublished": "2017-11-10T23:00:00",
"dateReserved": "2017-11-10T00:00:00",
"dateUpdated": "2024-08-05T20:35:21.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-7255
Vulnerability from cvelistv5
Published
2017-03-24 15:00
Modified
2024-08-05 15:56
Severity ?
EPSS score ?
Summary
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.03i0.com/index.php/archives/113/ | x_refsource_MISC | |
| http://www.securityfocus.com/bid/97203 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:56:36.325Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"name": "97203",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/97203"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "XSS exists in the CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" feature via the m1_title parameter. Someone must login to conduct the attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-04-04T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"name": "97203",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/97203"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-7255",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XSS exists in the CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" feature via the m1_title parameter. Someone must login to conduct the attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.03i0.com/index.php/archives/113/",
"refsource": "MISC",
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"name": "97203",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97203"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-7255",
"datePublished": "2017-03-24T15:00:00",
"dateReserved": "2017-03-24T00:00:00",
"dateUpdated": "2024-08-05T15:56:36.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-23241
Vulnerability from cvelistv5
Published
2021-07-26 20:12
Modified
2024-08-04 14:58
Severity ?
EPSS score ?
Summary
Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12322 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:58:14.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12322"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in \"Extra\" via \u0027News \u003e Article\" feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-26T20:12:55",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12322"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-23241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in \"Extra\" via \u0027News \u003e Article\" feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12322",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12322"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-23241",
"datePublished": "2021-07-26T20:12:55",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:58:14.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-36409
Vulnerability from cvelistv5
Published
2021-07-02 17:51
Modified
2024-08-04 17:23
Severity ?
EPSS score ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Category" parameter under the "Categories" module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12325 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:23:10.438Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Add Category\" parameter under the \"Categories\" module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T17:51:34",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36409",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Add Category\" parameter under the \"Categories\" module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12325",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36409",
"datePublished": "2021-07-02T17:51:34",
"dateReserved": "2021-07-01T00:00:00",
"dateUpdated": "2024-08-04T17:23:10.438Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43358
Vulnerability from cvelistv5
Published
2023-10-23 00:00
Modified
2024-09-12 15:39
Severity ?
EPSS score ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu component.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.826Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43358",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T15:39:33.710232Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T15:39:51.927Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-23T21:36:23.675884",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News"
},
{
"url": "https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43358",
"datePublished": "2023-10-23T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-12T15:39:51.927Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9053
Vulnerability from cvelistv5
Published
2019-03-26 16:15
Modified
2024-08-04 21:38
Severity ?
EPSS score ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | x_refsource_CONFIRM | |
| https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | x_refsource_MISC | |
| https://www.exploit-db.com/exploits/46635/ | exploit, x_refsource_EXPLOIT-DB | |
| http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.318Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"name": "46635",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/46635/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-02T16:06:13",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"name": "46635",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/46635/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9053",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"name": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg",
"refsource": "MISC",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"name": "46635",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/46635/"
},
{
"name": "http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9053",
"datePublished": "2019-03-26T16:15:38",
"dateReserved": "2019-02-23T00:00:00",
"dateUpdated": "2024-08-04T21:38:46.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43872
Vulnerability from cvelistv5
Published
2023-09-28 00:00
Modified
2024-09-23 19:18
Severity ?
EPSS score ?
Summary
A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:52:11.841Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43872",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-23T19:18:30.026514Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-23T19:18:39.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-28T13:44:19.905528",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43872",
"datePublished": "2023-09-28T00:00:00",
"dateReserved": "2023-09-25T00:00:00",
"dateUpdated": "2024-09-23T19:18:39.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0551
Vulnerability from cvelistv5
Published
2007-01-29 17:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/33572 | vdb-entry, x_refsource_OSVDB | |
| http://securityreason.com/securityalert/2195 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/archive/1/457668/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/31658 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:30.557Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "33572",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/33572"
},
{
"name": "2195",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2195"
},
{
"name": "20070120 cmsimple 2.7 Remote File Include",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/457668/100/0/threaded"
},
{
"name": "cmsimple-cms-file-include(31658)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31658"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "33572",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/33572"
},
{
"name": "2195",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2195"
},
{
"name": "20070120 cmsimple 2.7 Remote File Include",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/457668/100/0/threaded"
},
{
"name": "cmsimple-cms-file-include(31658)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31658"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0551",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "33572",
"refsource": "OSVDB",
"url": "http://osvdb.org/33572"
},
{
"name": "2195",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2195"
},
{
"name": "20070120 cmsimple 2.7 Remote File Include",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/457668/100/0/threaded"
},
{
"name": "cmsimple-cms-file-include(31658)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31658"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0551",
"datePublished": "2007-01-29T17:00:00",
"dateReserved": "2007-01-29T00:00:00",
"dateUpdated": "2024-08-07T12:19:30.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10523
Vulnerability from cvelistv5
Published
2018-04-27 18:00
Modified
2024-09-16 23:01
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cmsms_cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:39:08.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-27T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10523",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cmsms_cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10523",
"datePublished": "2018-04-27T18:00:00Z",
"dateReserved": "2018-04-27T00:00:00Z",
"dateUpdated": "2024-09-16T23:01:14.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-6844
Vulnerability from cvelistv5
Published
2007-01-03 02:00
Modified
2024-08-07 20:42
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the optional user comment module in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the user comment form.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/21756 | vdb-entry, x_refsource_BID | |
| http://securitytracker.com/id?1017445 | vdb-entry, x_refsource_SECTRACK | |
| http://securityreason.com/securityalert/2087 | third-party-advisory, x_refsource_SREASON | |
| http://www.l0j1k.com/security/CMSMadeSimple_1.0.2_25Dec06.txt | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/455306/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:42:07.574Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "21756",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/21756"
},
{
"name": "1017445",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017445"
},
{
"name": "2087",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2087"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.l0j1k.com/security/CMSMadeSimple_1.0.2_25Dec06.txt"
},
{
"name": "20061225 XSS - CMS Made Simple v1.0.2",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/455306/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-12-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the optional user comment module in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the user comment form."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-17T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "21756",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/21756"
},
{
"name": "1017445",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017445"
},
{
"name": "2087",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2087"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.l0j1k.com/security/CMSMadeSimple_1.0.2_25Dec06.txt"
},
{
"name": "20061225 XSS - CMS Made Simple v1.0.2",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/455306/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6844",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the optional user comment module in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the user comment form."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "21756",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/21756"
},
{
"name": "1017445",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017445"
},
{
"name": "2087",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2087"
},
{
"name": "http://www.l0j1k.com/security/CMSMadeSimple_1.0.2_25Dec06.txt",
"refsource": "MISC",
"url": "http://www.l0j1k.com/security/CMSMadeSimple_1.0.2_25Dec06.txt"
},
{
"name": "20061225 XSS - CMS Made Simple v1.0.2",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/455306/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6844",
"datePublished": "2007-01-03T02:00:00",
"dateReserved": "2007-01-02T00:00:00",
"dateUpdated": "2024-08-07T20:42:07.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5444
Vulnerability from cvelistv5
Published
2007-10-14 18:00
Modified
2024-08-07 15:31
Severity ?
EPSS score ?
Summary
CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/41033 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/archive/1/481984/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/3223 | third-party-advisory, x_refsource_SREASON |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:31:58.119Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "41033",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/41033"
},
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "3223",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3223"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-10-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "41033",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/41033"
},
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "3223",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3223"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5444",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "41033",
"refsource": "OSVDB",
"url": "http://osvdb.org/41033"
},
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "3223",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3223"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5444",
"datePublished": "2007-10-14T18:00:00",
"dateReserved": "2007-10-14T00:00:00",
"dateUpdated": "2024-08-07T15:31:58.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1000158
Vulnerability from cvelistv5
Published
2018-04-18 19:00
Modified
2024-08-05 12:33
Severity ?
EPSS score ?
Summary
cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/11762 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:33:49.474Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11762"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2018-04-06T00:00:00",
"datePublic": "2018-04-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line \"$url = $config[\u0027admin_url\u0027] . \u0027/login.php?recoverme=\u0027 . $code;\" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-18T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11762"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2018-04-06T14:09:26.581628",
"DATE_REQUESTED": "2018-03-25T05:34:09",
"ID": "CVE-2018-1000158",
"REQUESTER": "me@spoock.com",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line \"$url = $config[\u0027admin_url\u0027] . \u0027/login.php?recoverme=\u0027 . $code;\" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/11762",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/11762"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-1000158",
"datePublished": "2018-04-18T19:00:00",
"dateReserved": "2018-03-25T00:00:00",
"dateUpdated": "2024-08-05T12:33:49.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-4310
Vulnerability from cvelistv5
Published
2019-11-26 22:57
Modified
2024-08-07 00:01
Severity ?
EPSS score ?
Summary
The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2011/08/Announcing-CMSMS-1-9-4-3---Security-Release/ | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The CMS Made Simple Foundation | CMSMS |
Version: before 1.9.4.3 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:01:51.566Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2011/08/Announcing-CMSMS-1-9-4-3---Security-Release/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "CMSMS",
"vendor": "The CMS Made Simple Foundation",
"versions": [
{
"status": "affected",
"version": "before 1.9.4.3"
}
]
}
],
"datePublic": "2011-08-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Other",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-26T22:59:25",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2011/08/Announcing-CMSMS-1-9-4-3---Security-Release/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-4310",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "CMSMS",
"version": {
"version_data": [
{
"version_value": "before 1.9.4.3"
}
]
}
}
]
},
"vendor_name": "The CMS Made Simple Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2011/08/Announcing-CMSMS-1-9-4-3---Security-Release/",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2011/08/Announcing-CMSMS-1-9-4-3---Security-Release/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-4310",
"datePublished": "2019-11-26T22:57:43",
"dateReserved": "2011-11-04T00:00:00",
"dateUpdated": "2024-08-07T00:01:51.566Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43355
Vulnerability from cvelistv5
Published
2023-10-20 00:00
Modified
2024-09-12 14:54
Severity ?
EPSS score ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences - Add user component.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.721Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CMSmadesimple-Reflected-XSS---Add-user"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43355",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T14:53:02.438225Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T14:54:03.401Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences - Add user component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T21:45:58.506581",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CMSmadesimple-Reflected-XSS---Add-user"
},
{
"url": "https://github.com/sromanhu/CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43355",
"datePublished": "2023-10-20T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-12T14:54:03.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-17462
Vulnerability from cvelistv5
Published
2020-08-14 14:10
Modified
2024-08-04 13:53
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.exploit-db.com/exploits/48742 | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:53:17.518Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "48742",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/48742"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2020-07-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-14T14:10:31",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "48742",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/48742"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-17462",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "48742",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/48742"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-17462",
"datePublished": "2020-08-14T14:10:31",
"dateReserved": "2020-08-09T00:00:00",
"dateUpdated": "2024-08-04T13:53:17.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-5963
Vulnerability from cvelistv5
Published
2018-01-25 16:00
Modified
2024-08-05 05:47
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/ | x_refsource_MISC | |
| http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html | x_refsource_MISC | |
| http://seclists.org/fulldisclosure/2018/Jan/80 | mailing-list, x_refsource_FULLDISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T05:47:56.173Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html"
},
{
"name": "20180123 CMS Made Simple 2.2.5 [Stored Cross-Site Scripting]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/80"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-01-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-25T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html"
},
{
"name": "20180123 CMS Made Simple 2.2.5 [Stored Cross-Site Scripting]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/80"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-5963",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/",
"refsource": "MISC",
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/"
},
{
"name": "http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html"
},
{
"name": "20180123 CMS Made Simple 2.2.5 [Stored Cross-Site Scripting]",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2018/Jan/80"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-5963",
"datePublished": "2018-01-25T16:00:00",
"dateReserved": "2018-01-21T00:00:00",
"dateUpdated": "2024-08-05T05:47:56.173Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43357
Vulnerability from cvelistv5
Published
2023-10-20 00:00
Modified
2024-09-12 14:50
Severity ?
EPSS score ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.759Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43357",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T14:49:00.727985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T14:50:18.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T21:28:46.670571",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43357",
"datePublished": "2023-10-20T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-12T14:50:18.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-36413
Vulnerability from cvelistv5
Published
2021-07-02 17:51
Modified
2024-08-04 17:30
Severity ?
EPSS score ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Exclude these IP addresses from the "Site Down" status" parameter under the "Maintenance Mode" module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12325 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:30:06.840Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Exclude these IP addresses from the \"Site Down\" status\" parameter under the \"Maintenance Mode\" module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T17:51:54",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36413",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Exclude these IP addresses from the \"Site Down\" status\" parameter under the \"Maintenance Mode\" module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12325",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36413",
"datePublished": "2021-07-02T17:51:54",
"dateReserved": "2021-07-01T00:00:00",
"dateUpdated": "2024-08-04T17:30:06.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5056
Vulnerability from cvelistv5
Published
2007-09-24 22:00
Modified
2024-08-07 15:17
Severity ?
EPSS score ?
Summary
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:17:28.218Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "openrealty-lastmodule-code-execution(40395)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40395"
},
{
"name": "25768",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/25768"
},
{
"name": "sapidcmf-lastmodule-code-execution(40396)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40396"
},
{
"name": "40596",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/40596"
},
{
"name": "5098",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/5098"
},
{
"name": "pacercms-lastmodule-code-execution(40389)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40389"
},
{
"name": "28886",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28886"
},
{
"name": "ADV-2007-3261",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/3261"
},
{
"name": "26928",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/26928"
},
{
"name": "41422",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/41422"
},
{
"name": "journalness-lastmodule-code-execution(40393)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40393"
},
{
"name": "41426",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/41426"
},
{
"name": "28874",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28874"
},
{
"name": "cmsmadesimple-adodbperfmod-code-execution(36733)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36733"
},
{
"name": "5090",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/5090"
},
{
"name": "41428",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/41428"
},
{
"name": "5097",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/5097"
},
{
"name": "20070924 CMS Made Simple eval injection is really an ADOdb Lite problem",
"tags": [
"mailing-list",
"x_refsource_VIM",
"x_transferred"
],
"url": "http://www.attrition.org/pipermail/vim/2007-September/001800.html"
},
{
"name": "28873",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28873"
},
{
"name": "4442",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/4442"
},
{
"name": "5091",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/5091"
},
{
"name": "28859",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28859"
},
{
"name": "41427",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/41427"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-09-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "openrealty-lastmodule-code-execution(40395)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40395"
},
{
"name": "25768",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/25768"
},
{
"name": "sapidcmf-lastmodule-code-execution(40396)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40396"
},
{
"name": "40596",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/40596"
},
{
"name": "5098",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/5098"
},
{
"name": "pacercms-lastmodule-code-execution(40389)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40389"
},
{
"name": "28886",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28886"
},
{
"name": "ADV-2007-3261",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/3261"
},
{
"name": "26928",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/26928"
},
{
"name": "41422",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/41422"
},
{
"name": "journalness-lastmodule-code-execution(40393)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40393"
},
{
"name": "41426",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/41426"
},
{
"name": "28874",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28874"
},
{
"name": "cmsmadesimple-adodbperfmod-code-execution(36733)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36733"
},
{
"name": "5090",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/5090"
},
{
"name": "41428",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/41428"
},
{
"name": "5097",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/5097"
},
{
"name": "20070924 CMS Made Simple eval injection is really an ADOdb Lite problem",
"tags": [
"mailing-list",
"x_refsource_VIM"
],
"url": "http://www.attrition.org/pipermail/vim/2007-September/001800.html"
},
{
"name": "28873",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28873"
},
{
"name": "4442",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/4442"
},
{
"name": "5091",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/5091"
},
{
"name": "28859",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28859"
},
{
"name": "41427",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/41427"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5056",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "openrealty-lastmodule-code-execution(40395)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40395"
},
{
"name": "25768",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/25768"
},
{
"name": "sapidcmf-lastmodule-code-execution(40396)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40396"
},
{
"name": "40596",
"refsource": "OSVDB",
"url": "http://osvdb.org/40596"
},
{
"name": "5098",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/5098"
},
{
"name": "pacercms-lastmodule-code-execution(40389)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40389"
},
{
"name": "28886",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28886"
},
{
"name": "ADV-2007-3261",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/3261"
},
{
"name": "26928",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26928"
},
{
"name": "41422",
"refsource": "OSVDB",
"url": "http://osvdb.org/41422"
},
{
"name": "journalness-lastmodule-code-execution(40393)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40393"
},
{
"name": "41426",
"refsource": "OSVDB",
"url": "http://osvdb.org/41426"
},
{
"name": "28874",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28874"
},
{
"name": "cmsmadesimple-adodbperfmod-code-execution(36733)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36733"
},
{
"name": "5090",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/5090"
},
{
"name": "41428",
"refsource": "OSVDB",
"url": "http://osvdb.org/41428"
},
{
"name": "5097",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/5097"
},
{
"name": "20070924 CMS Made Simple eval injection is really an ADOdb Lite problem",
"refsource": "VIM",
"url": "http://www.attrition.org/pipermail/vim/2007-September/001800.html"
},
{
"name": "28873",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28873"
},
{
"name": "4442",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/4442"
},
{
"name": "5091",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/5091"
},
{
"name": "28859",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28859"
},
{
"name": "41427",
"refsource": "OSVDB",
"url": "http://osvdb.org/41427"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5056",
"datePublished": "2007-09-24T22:00:00",
"dateReserved": "2007-09-24T00:00:00",
"dateUpdated": "2024-08-07T15:17:28.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-1992
Vulnerability from cvelistv5
Published
2012-04-11 10:00
Modified
2024-08-06 19:17
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt | x_refsource_MISC | |
| http://www.securityfocus.com/bid/52850 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:27.642Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt"
},
{
"name": "52850",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52850"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-04-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-11-20T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt"
},
{
"name": "52850",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52850"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1992",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt",
"refsource": "MISC",
"url": "http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt"
},
{
"name": "52850",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52850"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1992",
"datePublished": "2012-04-11T10:00:00",
"dateReserved": "2012-04-02T00:00:00",
"dateUpdated": "2024-08-06T19:17:27.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5441
Vulnerability from cvelistv5
Published
2007-10-14 18:00
Modified
2024-08-07 15:31
Severity ?
EPSS score ?
Summary
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an "admin/adminlog.php?page=1" request.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/481984/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://osvdb.org/45481 | vdb-entry, x_refsource_OSVDB | |
| http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/ | x_refsource_CONFIRM | |
| http://securityreason.com/securityalert/3223 | third-party-advisory, x_refsource_SREASON |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:31:58.337Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "45481",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/45481"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"name": "3223",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3223"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-10-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an \"admin/adminlog.php?page=1\" request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "45481",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/45481"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"name": "3223",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3223"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5441",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an \"admin/adminlog.php?page=1\" request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "45481",
"refsource": "OSVDB",
"url": "http://osvdb.org/45481"
},
{
"name": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/",
"refsource": "CONFIRM",
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"name": "3223",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3223"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5441",
"datePublished": "2007-10-14T18:00:00",
"dateReserved": "2007-10-14T00:00:00",
"dateUpdated": "2024-08-07T15:31:58.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-36969
Vulnerability from cvelistv5
Published
2023-07-06 00:00
Modified
2024-11-19 17:16
Severity ?
EPSS score ?
Summary
CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:01:10.072Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://okankurtulus.com.tr/2023/06/26/cms-made-simple-v2-2-17-file-upload-remote-code-execution-rce-authenticated/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-36969",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-19T17:16:17.714847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T17:16:26.469Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-06T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://okankurtulus.com.tr/2023/06/26/cms-made-simple-v2-2-17-file-upload-remote-code-execution-rce-authenticated/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-36969",
"datePublished": "2023-07-06T00:00:00",
"dateReserved": "2023-06-28T00:00:00",
"dateUpdated": "2024-11-19T17:16:26.469Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10522
Vulnerability from cvelistv5
Published
2018-04-27 18:00
Modified
2024-09-17 01:35
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cmsms_cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:39:07.955Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file view\" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-27T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10522",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file view\" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cmsms_cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10522",
"datePublished": "2018-04-27T18:00:00Z",
"dateReserved": "2018-04-27T00:00:00Z",
"dateUpdated": "2024-09-17T01:35:50.145Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-20464
Vulnerability from cvelistv5
Published
2018-12-25 23:00
Modified
2024-08-05 12:05
Severity ?
EPSS score ?
Summary
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/Xmansec/cmsms_vul | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:05:16.896Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Xmansec/cmsms_vul"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-12-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user\u0027s mailbox with the wrong format. The response contains the user\u0027s previously entered email address."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-12-25T23:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Xmansec/cmsms_vul"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-20464",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user\u0027s mailbox with the wrong format. The response contains the user\u0027s previously entered email address."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Xmansec/cmsms_vul",
"refsource": "MISC",
"url": "https://github.com/Xmansec/cmsms_vul"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-20464",
"datePublished": "2018-12-25T23:00:00",
"dateReserved": "2018-12-25T00:00:00",
"dateUpdated": "2024-08-05T12:05:16.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-14926
Vulnerability from cvelistv5
Published
2020-06-19 17:03
Modified
2024-08-04 13:00
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12324 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T13:00:52.108Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12324"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-19T17:03:03",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12324"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-14926",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12324",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12324"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-14926",
"datePublished": "2020-06-19T17:03:03",
"dateReserved": "2020-06-19T00:00:00",
"dateUpdated": "2024-08-04T13:00:52.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10029
Vulnerability from cvelistv5
Published
2018-04-11 19:00
Modified
2024-09-16 16:28
Severity ?
EPSS score ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/zxyxx/cmsms_vul | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:00.769Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-11T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10029",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zxyxx/cmsms_vul",
"refsource": "MISC",
"url": "https://github.com/zxyxx/cmsms_vul"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10029",
"datePublished": "2018-04-11T19:00:00Z",
"dateReserved": "2018-04-11T00:00:00Z",
"dateUpdated": "2024-09-16T16:28:44.505Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43356
Vulnerability from cvelistv5
Published
2023-10-20 00:00
Modified
2024-09-12 14:52
Severity ?
EPSS score ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.635Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43356",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T14:51:52.637145Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T14:52:19.299Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T21:52:40.732249",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43356",
"datePublished": "2023-10-20T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-12T14:52:19.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-16798
Vulnerability from cvelistv5
Published
2017-11-12 18:00
Modified
2024-08-05 20:35
Severity ?
EPSS score ?
Summary
In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or .svg.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:35:21.044Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-11-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a \"php\" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or .svg."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-11-12T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-16798",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a \"php\" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or .svg."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md",
"refsource": "MISC",
"url": "https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-16798",
"datePublished": "2017-11-12T18:00:00",
"dateReserved": "2017-11-12T00:00:00",
"dateUpdated": "2024-08-05T20:35:21.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-36415
Vulnerability from cvelistv5
Published
2021-07-02 17:51
Modified
2024-08-04 17:30
Severity ?
EPSS score ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Stylesheet" parameter under the "Stylesheets" module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12325 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:30:06.836Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Create a new Stylesheet\" parameter under the \"Stylesheets\" module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T17:51:58",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36415",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Create a new Stylesheet\" parameter under the \"Stylesheets\" module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12325",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36415",
"datePublished": "2021-07-02T17:51:58",
"dateReserved": "2021-07-01T00:00:00",
"dateUpdated": "2024-08-04T17:30:06.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10031
Vulnerability from cvelistv5
Published
2018-04-11 19:00
Modified
2024-09-16 21:08
Severity ?
EPSS score ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/zxyxx/cmsms_vul | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:00.634Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-11T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10031",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zxyxx/cmsms_vul",
"refsource": "MISC",
"url": "https://github.com/zxyxx/cmsms_vul"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10031",
"datePublished": "2018-04-11T19:00:00Z",
"dateReserved": "2018-04-11T00:00:00Z",
"dateUpdated": "2024-09-16T21:08:16.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-8912
Vulnerability from cvelistv5
Published
2017-05-12 06:54
Modified
2024-08-05 16:48
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.exploit-db.com/exploits/41997/ | exploit, x_refsource_EXPLOIT-DB | |
| https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cms_made_simple",
"vendor": "cmsmadesimple",
"versions": [
{
"status": "affected",
"version": "2.1.6"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2017-8912",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-23T18:18:49.599887Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-23T18:22:08.463Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:48:22.694Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "41997",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/41997/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-05-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is \"a feature, not a bug."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-15T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "41997",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/41997/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-8912",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is \"a feature, not a bug.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "41997",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/41997/"
},
{
"name": "https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/",
"refsource": "MISC",
"url": "https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-8912",
"datePublished": "2017-05-12T06:54:00",
"dateReserved": "2017-05-12T00:00:00",
"dateUpdated": "2024-08-05T16:48:22.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-17630
Vulnerability from cvelistv5
Published
2019-10-16 12:23
Modified
2024-08-05 01:47
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
References
| ▼ | URL | Tags |
|---|---|---|
| https://forum.cmsmadesimple.org/viewforum.php?f=1 | x_refsource_MISC | |
| http://dev.cmsmadesimple.org/bug/view/12149 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:47:13.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12149"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the \"News \u003e Add Article\" screen."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-16T12:23:59",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12149"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17630",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the \"News \u003e Add Article\" screen."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://forum.cmsmadesimple.org/viewforum.php?f=1",
"refsource": "MISC",
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
},
{
"name": "http://dev.cmsmadesimple.org/bug/view/12149",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12149"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17630",
"datePublished": "2019-10-16T12:23:59",
"dateReserved": "2019-10-16T00:00:00",
"dateUpdated": "2024-08-05T01:47:13.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5443
Vulnerability from cvelistv5
Published
2007-10-14 18:00
Modified
2024-08-07 15:31
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags.
References
| ▼ | URL | Tags |
|---|---|---|
| http://osvdb.org/42471 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/archive/1/481984/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://osvdb.org/42472 | vdb-entry, x_refsource_OSVDB | |
| http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/ | x_refsource_CONFIRM | |
| http://securityreason.com/securityalert/3223 | third-party-advisory, x_refsource_SREASON |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:31:58.470Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "42471",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/42471"
},
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "42472",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/42472"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"name": "3223",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3223"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-10-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "42471",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/42471"
},
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "42472",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/42472"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"name": "3223",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3223"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5443",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "42471",
"refsource": "OSVDB",
"url": "http://osvdb.org/42471"
},
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "42472",
"refsource": "OSVDB",
"url": "http://osvdb.org/42472"
},
{
"name": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/",
"refsource": "CONFIRM",
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"name": "3223",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3223"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5443",
"datePublished": "2007-10-14T18:00:00",
"dateReserved": "2007-10-14T00:00:00",
"dateUpdated": "2024-08-07T15:31:58.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-2092
Vulnerability from cvelistv5
Published
2014-03-02 17:00
Modified
2024-08-06 10:05
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries.
References
| ▼ | URL | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html | x_refsource_MISC | |
| http://www.securityfocus.com/bid/65746 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:05:57.906Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html"
},
{
"name": "65746",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65746"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-05-14T16:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html"
},
{
"name": "65746",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65746"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2092",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html"
},
{
"name": "65746",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/65746"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2092",
"datePublished": "2014-03-02T17:00:00",
"dateReserved": "2014-02-24T00:00:00",
"dateUpdated": "2024-08-06T10:05:57.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-40961
Vulnerability from cvelistv5
Published
2022-06-09 00:00
Modified
2024-08-04 02:59
Severity ?
EPSS score ?
Summary
CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:59:30.888Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://seclists.org/fulldisclosure/2021/Mar/49"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://packetstormsecurity.com/files/161895/CMS-Made-Simple-2.2.15-SQL-Injection.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.soteritsecurity.com/blog/2023/01/CMS-Made-Simple_CVE-2021-40961.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple \u003c=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the \u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-06T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://seclists.org/fulldisclosure/2021/Mar/49"
},
{
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md"
},
{
"url": "https://packetstormsecurity.com/files/161895/CMS-Made-Simple-2.2.15-SQL-Injection.html"
},
{
"url": "https://www.soteritsecurity.com/blog/2023/01/CMS-Made-Simple_CVE-2021-40961.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-40961",
"datePublished": "2022-06-09T00:00:00",
"dateReserved": "2021-09-13T00:00:00",
"dateUpdated": "2024-08-04T02:59:30.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-36970
Vulnerability from cvelistv5
Published
2023-07-06 00:00
Modified
2024-11-19 17:14
Severity ?
EPSS score ?
Summary
A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:01:09.979Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://okankurtulus.com.tr/2023/06/27/cms-made-simple-v2-2-17-stored-cross-site-scripting-xss-authenticated/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-36970",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-19T17:13:54.621058Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T17:14:04.676Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-06T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://okankurtulus.com.tr/2023/06/27/cms-made-simple-v2-2-17-stored-cross-site-scripting-xss-authenticated/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-36970",
"datePublished": "2023-07-06T00:00:00",
"dateReserved": "2023-06-28T00:00:00",
"dateUpdated": "2024-11-19T17:14:04.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-23481
Vulnerability from cvelistv5
Published
2021-09-22 19:47
Modified
2024-08-04 14:58
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12317 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:58:15.075Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-22T19:47:33",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-23481",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12317",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-23481",
"datePublished": "2021-09-22T19:47:33",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:58:15.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-1482
Vulnerability from cvelistv5
Published
2010-05-12 15:00
Modified
2024-09-16 23:41
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade/ | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/39997 | vdb-entry, x_refsource_BID | |
| http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/511178 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T01:28:41.235Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade/"
},
{
"name": "39997",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/39997"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html"
},
{
"name": "20100507 CMS Made Simple: backend cross site scripting (XSS), CVE-2010-1482",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/511178"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-05-12T15:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade/"
},
{
"name": "39997",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/39997"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html"
},
{
"name": "20100507 CMS Made Simple: backend cross site scripting (XSS), CVE-2010-1482",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/511178"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-1482",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade/",
"refsource": "CONFIRM",
"url": "http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade/"
},
{
"name": "39997",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/39997"
},
{
"name": "http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html",
"refsource": "MISC",
"url": "http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html"
},
{
"name": "20100507 CMS Made Simple: backend cross site scripting (XSS), CVE-2010-1482",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/511178"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-1482",
"datePublished": "2010-05-12T15:00:00Z",
"dateReserved": "2010-04-20T00:00:00Z",
"dateUpdated": "2024-09-16T23:41:29.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2473
Vulnerability from cvelistv5
Published
2007-05-02 23:00
Modified
2024-08-07 13:42
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://blog.cmsmadesimple.org/2007/04/24/cms-made-simple-106-released/ | x_refsource_CONFIRM | |
| http://secunia.com/advisories/25082 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34044 | vdb-entry, x_refsource_XF | |
| http://www.scanit.be/advisory-2007-05-02.html | x_refsource_MISC | |
| http://www.vupen.com/english/advisories/2007/1628 | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/bid/23753 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/35744 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:42:32.537Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blog.cmsmadesimple.org/2007/04/24/cms-made-simple-106-released/"
},
{
"name": "25082",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/25082"
},
{
"name": "cmsmadesimple-stylesheet-sql-injection(34044)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34044"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.scanit.be/advisory-2007-05-02.html"
},
{
"name": "ADV-2007-1628",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1628"
},
{
"name": "23753",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23753"
},
{
"name": "35744",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35744"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blog.cmsmadesimple.org/2007/04/24/cms-made-simple-106-released/"
},
{
"name": "25082",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/25082"
},
{
"name": "cmsmadesimple-stylesheet-sql-injection(34044)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34044"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.scanit.be/advisory-2007-05-02.html"
},
{
"name": "ADV-2007-1628",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1628"
},
{
"name": "23753",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23753"
},
{
"name": "35744",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35744"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2473",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://blog.cmsmadesimple.org/2007/04/24/cms-made-simple-106-released/",
"refsource": "CONFIRM",
"url": "http://blog.cmsmadesimple.org/2007/04/24/cms-made-simple-106-released/"
},
{
"name": "25082",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25082"
},
{
"name": "cmsmadesimple-stylesheet-sql-injection(34044)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34044"
},
{
"name": "http://www.scanit.be/advisory-2007-05-02.html",
"refsource": "MISC",
"url": "http://www.scanit.be/advisory-2007-05-02.html"
},
{
"name": "ADV-2007-1628",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1628"
},
{
"name": "23753",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23753"
},
{
"name": "35744",
"refsource": "OSVDB",
"url": "http://osvdb.org/35744"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2473",
"datePublished": "2007-05-02T23:00:00",
"dateReserved": "2007-05-02T00:00:00",
"dateUpdated": "2024-08-07T13:42:32.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10082
Vulnerability from cvelistv5
Published
2018-04-13 05:00
Modified
2024-09-16 22:51
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:01.037Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-13T05:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10082",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10082",
"datePublished": "2018-04-13T05:00:00Z",
"dateReserved": "2018-04-13T00:00:00Z",
"dateUpdated": "2024-09-16T22:51:49.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-28999
Vulnerability from cvelistv5
Published
2023-05-08 00:00
Modified
2025-01-29 16:21
Severity ?
EPSS score ?
Summary
SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.243Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://seclists.org/fulldisclosure/2021/Mar/49"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-28999",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T16:21:30.748938Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T16:21:36.241Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-08T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://seclists.org/fulldisclosure/2021/Mar/49"
},
{
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-28999",
"datePublished": "2023-05-08T00:00:00.000Z",
"dateReserved": "2021-03-22T00:00:00.000Z",
"dateUpdated": "2025-01-29T16:21:36.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1000092
Vulnerability from cvelistv5
Published
2018-03-13 15:00
Modified
2024-08-05 12:33
Severity ?
EPSS score ?
Summary
CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/11715 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:33:49.276Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11715"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2018-02-19T00:00:00",
"datePublic": "2018-03-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-13T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11715"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2/19/2018 1:28:04",
"ID": "CVE-2018-1000092",
"REQUESTER": "strukt93@gmail.com",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/11715",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/11715"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-1000092",
"datePublished": "2018-03-13T15:00:00",
"dateReserved": "2018-02-21T00:00:00",
"dateUpdated": "2024-08-05T12:33:49.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-10017
Vulnerability from cvelistv5
Published
2019-03-24 21:31
Modified
2024-08-04 22:10
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12001 | x_refsource_MISC | |
| https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:10:09.398Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12001"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an \"Add a new Profile\" action to the File Picker."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-25T16:38:47",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12001"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-10017",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an \"Add a new Profile\" action to the File Picker."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12001",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12001"
},
{
"name": "https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/",
"refsource": "MISC",
"url": "https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-10017",
"datePublished": "2019-03-24T21:31:47",
"dateReserved": "2019-03-24T00:00:00",
"dateUpdated": "2024-08-04T22:10:09.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-9921
Vulnerability from cvelistv5
Published
2018-04-23 18:00
Modified
2024-08-05 07:24
Severity ?
EPSS score ?
Summary
In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request.
References
| ▼ | URL | Tags |
|---|---|---|
| https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:24:56.301Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-23T17:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-9921",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98",
"refsource": "MISC",
"url": "https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-9921",
"datePublished": "2018-04-23T18:00:00",
"dateReserved": "2018-04-10T00:00:00",
"dateUpdated": "2024-08-05T07:24:56.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-36412
Vulnerability from cvelistv5
Published
2021-07-02 17:51
Modified
2024-08-04 17:30
Severity ?
EPSS score ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Search Text" field under the "Admin Search" module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12325 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:30:07.293Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Search Text\" field under the \"Admin Search\" module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T17:51:40",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36412",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Search Text\" field under the \"Admin Search\" module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12325",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36412",
"datePublished": "2021-07-02T17:51:40",
"dateReserved": "2021-07-01T00:00:00",
"dateUpdated": "2024-08-04T17:30:07.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0610
Vulnerability from cvelistv5
Published
2007-01-31 01:00
Modified
2024-08-07 12:26
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/23951 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/22250 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/31841 | vdb-entry, x_refsource_XF | |
| http://osvdb.org/32976 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:26:53.568Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "23951",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23951"
},
{
"name": "22250",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22250"
},
{
"name": "cmsimple-sender-xss(31841)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31841"
},
{
"name": "32976",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32976"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "23951",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23951"
},
{
"name": "22250",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22250"
},
{
"name": "cmsimple-sender-xss(31841)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31841"
},
{
"name": "32976",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32976"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0610",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "23951",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23951"
},
{
"name": "22250",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22250"
},
{
"name": "cmsimple-sender-xss(31841)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31841"
},
{
"name": "32976",
"refsource": "OSVDB",
"url": "http://osvdb.org/32976"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0610",
"datePublished": "2007-01-31T01:00:00",
"dateReserved": "2007-01-30T00:00:00",
"dateUpdated": "2024-08-07T12:26:53.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43359
Vulnerability from cvelistv5
Published
2023-10-19 00:00
Modified
2024-09-12 19:52
Severity ?
EPSS score ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.897Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43359",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T19:51:33.249569Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T19:52:44.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-19T21:33:18.928002",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43359",
"datePublished": "2023-10-19T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-12T19:52:44.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-7257
Vulnerability from cvelistv5
Published
2017-03-24 15:00
Modified
2024-08-05 15:56
Severity ?
EPSS score ?
Summary
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.03i0.com/index.php/archives/113/ | x_refsource_MISC | |
| http://www.securityfocus.com/bid/97205 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:56:36.374Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"name": "97205",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/97205"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "XSS exists in the CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" feature via the m1_content parameter. Someone must login to conduct the attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-30T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"name": "97205",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/97205"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-7257",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XSS exists in the CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" feature via the m1_content parameter. Someone must login to conduct the attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.03i0.com/index.php/archives/113/",
"refsource": "MISC",
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"name": "97205",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97205"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-7257",
"datePublished": "2017-03-24T15:00:00",
"dateReserved": "2017-03-24T00:00:00",
"dateUpdated": "2024-08-05T15:56:36.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10081
Vulnerability from cvelistv5
Published
2018-04-13 05:00
Modified
2024-09-16 19:04
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:01.143Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the \"0e\" substring."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-13T05:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10081",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the \"0e\" substring."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10081",
"datePublished": "2018-04-13T05:00:00Z",
"dateReserved": "2018-04-13T00:00:00Z",
"dateUpdated": "2024-09-16T19:04:45.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-9668
Vulnerability from cvelistv5
Published
2017-06-18 21:00
Modified
2024-08-05 17:18
Severity ?
EPSS score ?
Summary
In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/XiaoZhis/ProjectSend/issues/2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T17:18:00.272Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/XiaoZhis/ProjectSend/issues/2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-06-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In admin\\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-06-18T21:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/XiaoZhis/ProjectSend/issues/2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-9668",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In admin\\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/XiaoZhis/ProjectSend/issues/2",
"refsource": "MISC",
"url": "https://github.com/XiaoZhis/ProjectSend/issues/2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-9668",
"datePublished": "2017-06-18T21:00:00",
"dateReserved": "2017-06-15T00:00:00",
"dateUpdated": "2024-08-05T17:18:00.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-3884
Vulnerability from cvelistv5
Published
2010-10-08 20:00
Modified
2024-09-16 19:25
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/40031 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:26:12.113Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "40031",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40031"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-10-08T20:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "40031",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40031"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-3884",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "40031",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40031"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-3884",
"datePublished": "2010-10-08T20:00:00Z",
"dateReserved": "2010-10-08T00:00:00Z",
"dateUpdated": "2024-09-16T19:25:18.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-2797
Vulnerability from cvelistv5
Published
2010-10-08 20:00
Modified
2024-09-17 02:53
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.cmsmadesimple.org/2010/07/3/announcing-cms-made-simple-1-8-1-mankara/ | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2010/08/01/2 | mailing-list, x_refsource_MLIST | |
| http://secunia.com/advisories/40031 | third-party-advisory, x_refsource_SECUNIA | |
| http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html | x_refsource_MISC | |
| http://www.openwall.com/lists/oss-security/2010/08/02/8 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:46:48.535Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.cmsmadesimple.org/2010/07/3/announcing-cms-made-simple-1-8-1-mankara/"
},
{
"name": "[oss-security] 20100802 CVE request: cmsmadesimple \u003c 1.8.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2010/08/01/2"
},
{
"name": "40031",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40031"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html"
},
{
"name": "[oss-security] 20100802 Re: CVE request: cmsmadesimple \u003c 1.8.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2010/08/02/8"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-10-08T20:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.cmsmadesimple.org/2010/07/3/announcing-cms-made-simple-1-8-1-mankara/"
},
{
"name": "[oss-security] 20100802 CVE request: cmsmadesimple \u003c 1.8.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2010/08/01/2"
},
{
"name": "40031",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40031"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html"
},
{
"name": "[oss-security] 20100802 Re: CVE request: cmsmadesimple \u003c 1.8.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2010/08/02/8"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2010-2797",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.cmsmadesimple.org/2010/07/3/announcing-cms-made-simple-1-8-1-mankara/",
"refsource": "CONFIRM",
"url": "http://www.cmsmadesimple.org/2010/07/3/announcing-cms-made-simple-1-8-1-mankara/"
},
{
"name": "[oss-security] 20100802 CVE request: cmsmadesimple \u003c 1.8.1",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2010/08/01/2"
},
{
"name": "40031",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40031"
},
{
"name": "http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html",
"refsource": "MISC",
"url": "http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html"
},
{
"name": "[oss-security] 20100802 Re: CVE request: cmsmadesimple \u003c 1.8.1",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2010/08/02/8"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-2797",
"datePublished": "2010-10-08T20:00:00Z",
"dateReserved": "2010-07-22T00:00:00Z",
"dateUpdated": "2024-09-17T02:53:33.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4167
Vulnerability from cvelistv5
Published
2013-10-11 22:00
Modified
2024-09-16 21:07
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/07/25/7 | mailing-list, x_refsource_MLIST | |
| http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=66590&p=299356 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2013/07/21/1 | mailing-list, x_refsource_MLIST | |
| https://twitter.com/LeakFree/status/336942367351394305 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:38:00.195Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20130725 Re: cve request: cms made simple XSS before 1.11.7",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/07/25/7"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=66590\u0026p=299356"
},
{
"name": "[oss-security] 20130721 cve request: cms made simple XSS before 1.11.7",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/07/21/1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://twitter.com/LeakFree/status/336942367351394305"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-10-11T22:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20130725 Re: cve request: cms made simple XSS before 1.11.7",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/07/25/7"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=66590\u0026p=299356"
},
{
"name": "[oss-security] 20130721 cve request: cms made simple XSS before 1.11.7",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/07/21/1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://twitter.com/LeakFree/status/336942367351394305"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-4167",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20130725 Re: cve request: cms made simple XSS before 1.11.7",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2013/07/25/7"
},
{
"name": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=66590\u0026p=299356",
"refsource": "CONFIRM",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=66590\u0026p=299356"
},
{
"name": "[oss-security] 20130721 cve request: cms made simple XSS before 1.11.7",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2013/07/21/1"
},
{
"name": "https://twitter.com/LeakFree/status/336942367351394305",
"refsource": "MISC",
"url": "https://twitter.com/LeakFree/status/336942367351394305"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4167",
"datePublished": "2013-10-11T22:00:00Z",
"dateReserved": "2013-06-12T00:00:00Z",
"dateUpdated": "2024-09-16T21:07:56.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-2392
Vulnerability from cvelistv5
Published
2005-07-27 04:00
Modified
2024-08-07 22:22
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1014556 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/16147 | third-party-advisory, x_refsource_SECUNIA | |
| http://lostmon.blogspot.com/2005/07/cmsimple-search-variable-xss.html | x_refsource_MISC | |
| http://www.cmsimple.dk/forum/viewtopic.php?t=2470 | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/14346 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/archive/1/442106/100/100/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.aria-security.net/advisory/cmsimple.txt | x_refsource_MISC | |
| http://www.osvdb.org/18128 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:22:49.048Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1014556",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1014556"
},
{
"name": "16147",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16147"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://lostmon.blogspot.com/2005/07/cmsimple-search-variable-xss.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.cmsimple.dk/forum/viewtopic.php?t=2470"
},
{
"name": "14346",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/14346"
},
{
"name": "20060803 CMSimple Cross Site Scripting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/442106/100/100/threaded"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.aria-security.net/advisory/cmsimple.txt"
},
{
"name": "18128",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/18128"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-07-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1014556",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1014556"
},
{
"name": "16147",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16147"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://lostmon.blogspot.com/2005/07/cmsimple-search-variable-xss.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.cmsimple.dk/forum/viewtopic.php?t=2470"
},
{
"name": "14346",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/14346"
},
{
"name": "20060803 CMSimple Cross Site Scripting",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/442106/100/100/threaded"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.aria-security.net/advisory/cmsimple.txt"
},
{
"name": "18128",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/18128"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2392",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1014556",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1014556"
},
{
"name": "16147",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16147"
},
{
"name": "http://lostmon.blogspot.com/2005/07/cmsimple-search-variable-xss.html",
"refsource": "MISC",
"url": "http://lostmon.blogspot.com/2005/07/cmsimple-search-variable-xss.html"
},
{
"name": "http://www.cmsimple.dk/forum/viewtopic.php?t=2470",
"refsource": "CONFIRM",
"url": "http://www.cmsimple.dk/forum/viewtopic.php?t=2470"
},
{
"name": "14346",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14346"
},
{
"name": "20060803 CMSimple Cross Site Scripting",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/442106/100/100/threaded"
},
{
"name": "http://www.aria-security.net/advisory/cmsimple.txt",
"refsource": "MISC",
"url": "http://www.aria-security.net/advisory/cmsimple.txt"
},
{
"name": "18128",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/18128"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2392",
"datePublished": "2005-07-27T04:00:00",
"dateReserved": "2005-07-27T00:00:00",
"dateUpdated": "2024-08-07T22:22:49.048Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10520
Vulnerability from cvelistv5
Published
2018-04-27 18:00
Modified
2024-09-16 17:32
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cmsms_cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:39:08.047Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"module remove\" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-27T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10520",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"module remove\" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cmsms_cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10520",
"datePublished": "2018-04-27T18:00:00Z",
"dateReserved": "2018-04-27T00:00:00Z",
"dateUpdated": "2024-09-16T17:32:48.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1000454
Vulnerability from cvelistv5
Published
2018-01-02 17:00
Modified
2024-09-16 19:57
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2017/07/Announcing-CMSMS-2.2.2-Hearts-Content | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:00:41.387Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2017/07/Announcing-CMSMS-2.2.2-Hearts-Content"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2017-12-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-02T17:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cmsmadesimple.org/2017/07/Announcing-CMSMS-2.2.2-Hearts-Content"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2017-12-29",
"ID": "CVE-2017-1000454",
"REQUESTER": "daniel@scrt.ch",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2017/07/Announcing-CMSMS-2.2.2-Hearts-Content",
"refsource": "MISC",
"url": "https://www.cmsmadesimple.org/2017/07/Announcing-CMSMS-2.2.2-Hearts-Content"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-1000454",
"datePublished": "2018-01-02T17:00:00Z",
"dateReserved": "2018-01-02T00:00:00Z",
"dateUpdated": "2024-09-16T19:57:05.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10515
Vulnerability from cvelistv5
Published
2018-04-27 18:00
Modified
2024-09-16 19:21
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cmsms_cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:39:07.671Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file unpack\" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-27T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10515",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file unpack\" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cmsms_cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10515",
"datePublished": "2018-04-27T18:00:00Z",
"dateReserved": "2018-04-27T00:00:00Z",
"dateUpdated": "2024-09-16T19:21:00.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-2784
Vulnerability from cvelistv5
Published
2016-05-26 14:00
Modified
2024-08-05 23:32
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
References
| ▼ | URL | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html | x_refsource_MISC | |
| http://seclists.org/fulldisclosure/2016/May/15 | mailing-list, x_refsource_FULLDISC | |
| http://www.securityfocus.com/archive/1/538272/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/ | x_refsource_CONFIRM | |
| https://www.exploit-db.com/exploits/39760/ | exploit, x_refsource_EXPLOIT-DB | |
| http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point/ | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:32:21.148Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html"
},
{
"name": "20160506 CVE-2016-2784: CMS Made Simple \u003c 2.1.3 \u0026 \u003c 1.12.2 Web server Cache Poisoning",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2016/May/15"
},
{
"name": "20160504 CVE-2016-2784: CMS Made Simple \u003c 2.1.3 \u0026 \u003c 1.12.2 Web server Cache Poisoning",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/538272/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/"
},
{
"name": "39760",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/39760/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html"
},
{
"name": "20160506 CVE-2016-2784: CMS Made Simple \u003c 2.1.3 \u0026 \u003c 1.12.2 Web server Cache Poisoning",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2016/May/15"
},
{
"name": "20160504 CVE-2016-2784: CMS Made Simple \u003c 2.1.3 \u0026 \u003c 1.12.2 Web server Cache Poisoning",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/538272/100/0/threaded"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/"
},
{
"name": "39760",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/39760/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-2784",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html"
},
{
"name": "20160506 CVE-2016-2784: CMS Made Simple \u003c 2.1.3 \u0026 \u003c 1.12.2 Web server Cache Poisoning",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2016/May/15"
},
{
"name": "20160504 CVE-2016-2784: CMS Made Simple \u003c 2.1.3 \u0026 \u003c 1.12.2 Web server Cache Poisoning",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/538272/100/0/threaded"
},
{
"name": "http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/",
"refsource": "CONFIRM",
"url": "http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/"
},
{
"name": "39760",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/39760/"
},
{
"name": "http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point/",
"refsource": "CONFIRM",
"url": "http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-2784",
"datePublished": "2016-05-26T14:00:00",
"dateReserved": "2016-02-29T00:00:00",
"dateUpdated": "2024-08-05T23:32:21.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10033
Vulnerability from cvelistv5
Published
2018-04-11 19:00
Modified
2024-09-16 19:47
Severity ?
EPSS score ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/zxyxx/cmsms_vul | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:00.742Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-11T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10033",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zxyxx/cmsms_vul",
"refsource": "MISC",
"url": "https://github.com/zxyxx/cmsms_vul"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10033",
"datePublished": "2018-04-11T19:00:00Z",
"dateReserved": "2018-04-11T00:00:00Z",
"dateUpdated": "2024-09-16T19:47:30.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-5450
Vulnerability from cvelistv5
Published
2012-12-03 21:00
Modified
2024-08-06 21:05
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html | x_refsource_MISC | |
| https://www.htbridge.com/advisory/HTB23121 | x_refsource_MISC | |
| http://secunia.com/advisories/51185 | third-party-advisory, x_refsource_SECUNIA | |
| http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=63545 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/79881 | vdb-entry, x_refsource_XF | |
| http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple&path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php&rev=8400&peg=8498 | x_refsource_CONFIRM | |
| http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:05:47.231Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.htbridge.com/advisory/HTB23121"
},
{
"name": "51185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51185"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"name": "cmsmadesimple-images-csrf(79881)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"name": "20121107 Cross-Site Request Forgery (CSRF) in CMS Made Simple",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-11-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.htbridge.com/advisory/HTB23121"
},
{
"name": "51185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51185"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"name": "cmsmadesimple-images-csrf(79881)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"name": "20121107 Cross-Site Request Forgery (CSRF) in CMS Made Simple",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-5450",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"name": "https://www.htbridge.com/advisory/HTB23121",
"refsource": "MISC",
"url": "https://www.htbridge.com/advisory/HTB23121"
},
{
"name": "51185",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/51185"
},
{
"name": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545",
"refsource": "CONFIRM",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"name": "cmsmadesimple-images-csrf(79881)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"name": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498",
"refsource": "CONFIRM",
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"name": "20121107 Cross-Site Request Forgery (CSRF) in CMS Made Simple",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-5450",
"datePublished": "2012-12-03T21:00:00",
"dateReserved": "2012-10-17T00:00:00",
"dateUpdated": "2024-08-06T21:05:47.231Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-11404
Vulnerability from cvelistv5
Published
2017-07-18 00:00
Modified
2024-09-16 18:04
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:05:30.517Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-18T00:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-11404",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html",
"refsource": "MISC",
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-11404",
"datePublished": "2017-07-18T00:00:00Z",
"dateReserved": "2017-07-17T00:00:00Z",
"dateUpdated": "2024-09-16T18:04:12.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10518
Vulnerability from cvelistv5
Published
2018-04-27 18:00
Modified
2024-09-16 20:36
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cmsms_cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:39:07.860Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file delete\" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-27T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10518",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file delete\" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cmsms_cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10518",
"datePublished": "2018-04-27T18:00:00Z",
"dateReserved": "2018-04-27T00:00:00Z",
"dateUpdated": "2024-09-16T20:36:54.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-36411
Vulnerability from cvelistv5
Published
2021-07-02 17:51
Modified
2024-08-04 17:23
Severity ?
EPSS score ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the {page_image} tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12325 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:23:10.534Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Path for the {page_image} tag:\" or \"Path for thumbnail field:\" parameters under the \"Content Editing Settings\" module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T17:51:38",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36411",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Path for the {page_image} tag:\" or \"Path for thumbnail field:\" parameters under the \"Content Editing Settings\" module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12325",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36411",
"datePublished": "2021-07-02T17:51:38",
"dateReserved": "2021-07-01T00:00:00",
"dateUpdated": "2024-08-04T17:23:10.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43352
Vulnerability from cvelistv5
Published
2023-10-26 00:00
Modified
2024-09-12 14:16
Severity ?
EPSS score ?
Summary
An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.732Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CMSmadesimple-SSTI--Content"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43352",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T18:12:58.807621Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T14:16:54.036Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-26T21:37:58.508243",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CMSmadesimple-SSTI--Content"
},
{
"url": "https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43352",
"datePublished": "2023-10-26T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-12T14:16:54.036Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-10106
Vulnerability from cvelistv5
Published
2019-03-26 21:52
Modified
2024-08-04 22:10
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12004 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:10:09.783Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12004"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has XSS via the \u0027moduleinterface.php\u0027 Name field, which is reachable via an \"Add Category\" action to the \"Site Admin Settings - News module\" section."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-26T21:52:33",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12004"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-10106",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.10 has XSS via the \u0027moduleinterface.php\u0027 Name field, which is reachable via an \"Add Category\" action to the \"Site Admin Settings - News module\" section."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12004",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12004"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-10106",
"datePublished": "2019-03-26T21:52:33",
"dateReserved": "2019-03-26T00:00:00",
"dateUpdated": "2024-08-04T22:10:09.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-5965
Vulnerability from cvelistv5
Published
2018-01-25 16:00
Modified
2024-08-05 05:47
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/ | x_refsource_MISC | |
| http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html | x_refsource_MISC | |
| http://seclists.org/fulldisclosure/2018/Jan/83 | mailing-list, x_refsource_FULLDISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T05:47:56.168Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html"
},
{
"name": "20180122 CMS Made Simple 2.2.5[Reflected Cross-Site Scripting]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/83"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-01-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-25T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html"
},
{
"name": "20180122 CMS Made Simple 2.2.5[Reflected Cross-Site Scripting]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/83"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-5965",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/",
"refsource": "MISC",
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
},
{
"name": "http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html"
},
{
"name": "20180122 CMS Made Simple 2.2.5[Reflected Cross-Site Scripting]",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2018/Jan/83"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-5965",
"datePublished": "2018-01-25T16:00:00",
"dateReserved": "2018-01-21T00:00:00",
"dateUpdated": "2024-08-05T05:47:56.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-6556
Vulnerability from cvelistv5
Published
2017-03-09 09:26
Modified
2024-08-05 15:33
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage > sitesetting > General Settings > globalmetadata" field.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.daimacn.com/?id=8 | x_refsource_MISC | |
| http://www.securityfocus.com/bid/96933 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:33:20.193Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.daimacn.com/?id=8"
},
{
"name": "96933",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96933"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the \"adminpage \u003e sitesetting \u003e General Settings \u003e globalmetadata\" field."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-17T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.daimacn.com/?id=8"
},
{
"name": "96933",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96933"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6556",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the \"adminpage \u003e sitesetting \u003e General Settings \u003e globalmetadata\" field."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.daimacn.com/?id=8",
"refsource": "MISC",
"url": "http://www.daimacn.com/?id=8"
},
{
"name": "96933",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96933"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-6556",
"datePublished": "2017-03-09T09:26:00",
"dateReserved": "2017-03-09T00:00:00",
"dateUpdated": "2024-08-05T15:33:20.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-18271
Vulnerability from cvelistv5
Published
2018-10-12 19:00
Modified
2024-09-17 00:45
Severity ?
EPSS score ?
Summary
XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:08:21.182Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php \"Content--\u003eNews--\u003eAdd Article\" action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-12T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-18271",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php \"Content--\u003eNews--\u003eAdd Article\" action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13",
"refsource": "MISC",
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-18271",
"datePublished": "2018-10-12T19:00:00Z",
"dateReserved": "2018-10-12T00:00:00Z",
"dateUpdated": "2024-09-17T00:45:37.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-28935
Vulnerability from cvelistv5
Published
2021-03-30 12:00
Modified
2024-08-03 21:55
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12432 | x_refsource_MISC | |
| http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:11.824Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12432"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin \u003e My Preferences \u003e Title field."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-22T17:06:20",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12432"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-28935",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin \u003e My Preferences \u003e Title field."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12432",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12432"
},
{
"name": "http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-28935",
"datePublished": "2021-03-30T12:00:23",
"dateReserved": "2021-03-19T00:00:00",
"dateUpdated": "2024-08-03T21:55:11.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9058
Vulnerability from cvelistv5
Published
2019-03-26 16:40
Modified
2024-08-04 21:38
Severity ?
EPSS score ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | x_refsource_CONFIRM | |
| https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.356Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-26T16:40:52",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9058",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"name": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg",
"refsource": "MISC",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9058",
"datePublished": "2019-03-26T16:40:52",
"dateReserved": "2019-02-23T00:00:00",
"dateUpdated": "2024-08-04T21:38:46.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43353
Vulnerability from cvelistv5
Published
2023-10-20 00:00
Modified
2024-09-12 14:58
Severity ?
EPSS score ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.705Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43353",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T14:58:17.159224Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T14:58:33.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T21:39:39.851413",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43353",
"datePublished": "2023-10-20T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-12T14:58:33.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-43154
Vulnerability from cvelistv5
Published
2022-04-13 22:20
Modified
2024-08-04 03:47
Severity ?
EPSS score ?
Summary
Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:13.608Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-04-13T22:20:22",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-43154",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated",
"refsource": "MISC",
"url": "https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-43154",
"datePublished": "2022-04-13T22:20:22",
"dateReserved": "2021-11-01T00:00:00",
"dateUpdated": "2024-08-04T03:47:13.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-36414
Vulnerability from cvelistv5
Published
2021-07-02 17:51
Modified
2024-08-04 17:30
Severity ?
EPSS score ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "URL (slug)" or "Extra" fields under the "Add Article" feature.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12325 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:30:06.907Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"URL (slug)\" or \"Extra\" fields under the \"Add Article\" feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T17:51:56",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36414",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"URL (slug)\" or \"Extra\" fields under the \"Add Article\" feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12325",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36414",
"datePublished": "2021-07-02T17:51:56",
"dateReserved": "2021-07-01T00:00:00",
"dateUpdated": "2024-08-04T17:30:06.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-6070
Vulnerability from cvelistv5
Published
2017-02-21 07:46
Modified
2024-08-05 15:18
Severity ?
EPSS score ?
Summary
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
References
| ▼ | URL | Tags |
|---|---|---|
| https://daylight-it.com/security-advisory-dlcs0001.html | x_refsource_MISC | |
| http://dev.cmsmadesimple.org/project/files/69 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:18:49.761Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-02-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-02-21T07:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6070",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://daylight-it.com/security-advisory-dlcs0001.html",
"refsource": "MISC",
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"name": "http://dev.cmsmadesimple.org/project/files/69",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/project/files/69"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-6070",
"datePublished": "2017-02-21T07:46:00",
"dateReserved": "2017-02-17T00:00:00",
"dateUpdated": "2024-08-05T15:18:49.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-23906
Vulnerability from cvelistv5
Published
2022-02-28 22:55
Modified
2024-08-03 03:59
Severity ?
EPSS score ?
Summary
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12502 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:59:21.993Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12502"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-28T22:55:14",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12502"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-23906",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12502",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12502"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-23906",
"datePublished": "2022-02-28T22:55:14",
"dateReserved": "2022-01-24T00:00:00",
"dateUpdated": "2024-08-03T03:59:21.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-2846
Vulnerability from cvelistv5
Published
2005-09-08 04:00
Modified
2024-08-07 22:45
Severity ?
EPSS score ?
Summary
PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=112552342004406&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/16654/ | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/14709 | vdb-entry, x_refsource_BID | |
| http://forum.cmsmadesimple.org/index.php/topic%2C1549.0.html | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:45:02.352Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20050831 CMS Made Simple \u003c= 0.10 - PHP injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112552342004406\u0026w=2"
},
{
"name": "16654",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16654/"
},
{
"name": "14709",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/14709"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://forum.cmsmadesimple.org/index.php/topic%2C1549.0.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-08-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20050831 CMS Made Simple \u003c= 0.10 - PHP injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112552342004406\u0026w=2"
},
{
"name": "16654",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16654/"
},
{
"name": "14709",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/14709"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://forum.cmsmadesimple.org/index.php/topic%2C1549.0.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2846",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20050831 CMS Made Simple \u003c= 0.10 - PHP injection",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=112552342004406\u0026w=2"
},
{
"name": "16654",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16654/"
},
{
"name": "14709",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14709"
},
{
"name": "http://forum.cmsmadesimple.org/index.php/topic,1549.0.html",
"refsource": "CONFIRM",
"url": "http://forum.cmsmadesimple.org/index.php/topic,1549.0.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2846",
"datePublished": "2005-09-08T04:00:00",
"dateReserved": "2005-09-08T00:00:00",
"dateUpdated": "2024-08-07T22:45:02.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-17226
Vulnerability from cvelistv5
Published
2019-10-06 17:04
Modified
2024-08-05 01:33
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12148 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:33:17.282Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12148"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin \u003e Module Manager \u003e Search Term field."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-06T17:04:36",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12148"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17226",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin \u003e Module Manager \u003e Search Term field."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12148",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12148"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17226",
"datePublished": "2019-10-06T17:04:36",
"dateReserved": "2019-10-06T00:00:00",
"dateUpdated": "2024-08-05T01:33:17.282Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-3882
Vulnerability from cvelistv5
Published
2010-10-08 20:00
Modified
2024-09-16 20:36
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add Field Definition, or (7) Add Shortcut module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/ | x_refsource_MISC | |
| http://secunia.com/advisories/40031 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:26:12.376Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
},
{
"name": "40031",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40031"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add Field Definition, or (7) Add Shortcut module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-10-08T20:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
},
{
"name": "40031",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40031"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-3882",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add Field Definition, or (7) Add Shortcut module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/",
"refsource": "MISC",
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
},
{
"name": "40031",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40031"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-3882",
"datePublished": "2010-10-08T20:00:00Z",
"dateReserved": "2010-10-08T00:00:00Z",
"dateUpdated": "2024-09-16T20:36:49.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-2245
Vulnerability from cvelistv5
Published
2014-03-05 15:00
Modified
2024-08-06 10:05
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/56996 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/65953 | vdb-entry, x_refsource_BID | |
| http://dev.cmsmadesimple.org/project/changelog/4602 | x_refsource_CONFIRM | |
| http://seclists.org/oss-sec/2014/q1/467 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:05:59.903Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "56996",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56996"
},
{
"name": "65953",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65953"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/4602"
},
{
"name": "[oss-security] 20140301 Re: CVE request: CMS Made Simple SQL injection fixed in 1.11.10",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q1/467"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the \"Modify News\" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-05T15:57:02",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "56996",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56996"
},
{
"name": "65953",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65953"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/4602"
},
{
"name": "[oss-security] 20140301 Re: CVE request: CMS Made Simple SQL injection fixed in 1.11.10",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q1/467"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-2245",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the \"Modify News\" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "56996",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56996"
},
{
"name": "65953",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/65953"
},
{
"name": "http://dev.cmsmadesimple.org/project/changelog/4602",
"refsource": "CONFIRM",
"url": "http://dev.cmsmadesimple.org/project/changelog/4602"
},
{
"name": "[oss-security] 20140301 Re: CVE request: CMS Made Simple SQL injection fixed in 1.11.10",
"refsource": "MLIST",
"url": "http://seclists.org/oss-sec/2014/q1/467"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-2245",
"datePublished": "2014-03-05T15:00:00",
"dateReserved": "2014-02-28T00:00:00",
"dateUpdated": "2024-08-06T10:05:59.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-10105
Vulnerability from cvelistv5
Published
2019-03-26 21:52
Modified
2024-08-04 22:10
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12002 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:10:09.782Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12002"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager \"Name\" field, which is reachable via a \"Create a new Template\" action to the Design Manager."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-26T21:52:22",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12002"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-10105",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager \"Name\" field, which is reachable via a \"Create a new Template\" action to the Design Manager."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12002",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12002"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-10105",
"datePublished": "2019-03-26T21:52:22",
"dateReserved": "2019-03-26T00:00:00",
"dateUpdated": "2024-08-04T22:10:09.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-20138
Vulnerability from cvelistv5
Published
2020-12-17 22:38
Modified
2024-08-04 14:15
Severity ?
EPSS score ?
Summary
Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:15:29.066Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-12-17T22:38:55",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-20138",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-20138",
"datePublished": "2020-12-17T22:38:55",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:15:29.066Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-23907
Vulnerability from cvelistv5
Published
2022-02-28 22:55
Modified
2024-08-03 03:59
Severity ?
EPSS score ?
Summary
CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12503 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:59:22.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12503"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-02-28T22:55:15",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12503"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2022-23907",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12503",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12503"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2022-23907",
"datePublished": "2022-02-28T22:55:15",
"dateReserved": "2022-01-24T00:00:00",
"dateUpdated": "2024-08-03T03:59:22.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-8058
Vulnerability from cvelistv5
Published
2018-03-12 03:00
Modified
2024-08-05 06:46
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:46:12.312Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-03-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-12T02:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-8058",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md",
"refsource": "MISC",
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-8058",
"datePublished": "2018-03-12T03:00:00",
"dateReserved": "2018-03-11T00:00:00",
"dateUpdated": "2024-08-05T06:46:12.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-5642
Vulnerability from cvelistv5
Published
2008-12-17 17:00
Modified
2024-08-07 10:56
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.exploit-db.com/exploits/7285 | exploit, x_refsource_EXPLOIT-DB | |
| http://secunia.com/advisories/32924 | third-party-advisory, x_refsource_SECUNIA | |
| http://securityreason.com/securityalert/4775 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/32535 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/46942 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2008/3306 | vdb-entry, x_refsource_VUPEN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:56:47.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "7285",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/7285"
},
{
"name": "32924",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32924"
},
{
"name": "4775",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/4775"
},
{
"name": "32535",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/32535"
},
{
"name": "cmsmadesimple-login-file-include(46942)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46942"
},
{
"name": "ADV-2008-3306",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2008/3306"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-11-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "7285",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/7285"
},
{
"name": "32924",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32924"
},
{
"name": "4775",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/4775"
},
{
"name": "32535",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/32535"
},
{
"name": "cmsmadesimple-login-file-include(46942)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46942"
},
{
"name": "ADV-2008-3306",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2008/3306"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-5642",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "7285",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/7285"
},
{
"name": "32924",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32924"
},
{
"name": "4775",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/4775"
},
{
"name": "32535",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/32535"
},
{
"name": "cmsmadesimple-login-file-include(46942)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46942"
},
{
"name": "ADV-2008-3306",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/3306"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-5642",
"datePublished": "2008-12-17T17:00:00",
"dateReserved": "2008-12-17T00:00:00",
"dateUpdated": "2024-08-07T10:56:47.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-6072
Vulnerability from cvelistv5
Published
2017-02-21 07:46
Modified
2024-08-05 15:18
Severity ?
EPSS score ?
Summary
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
References
| ▼ | URL | Tags |
|---|---|---|
| https://daylight-it.com/security-advisory-dlcs0001.html | x_refsource_MISC | |
| http://dev.cmsmadesimple.org/project/files/69 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:18:49.875Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-02-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-02-21T07:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6072",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://daylight-it.com/security-advisory-dlcs0001.html",
"refsource": "MISC",
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"name": "http://dev.cmsmadesimple.org/project/files/69",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/project/files/69"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-6072",
"datePublished": "2017-02-21T07:46:00",
"dateReserved": "2017-02-17T00:00:00",
"dateUpdated": "2024-08-05T15:18:49.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-10682
Vulnerability from cvelistv5
Published
2020-03-20 03:39
Modified
2024-08-04 11:06
Severity ?
EPSS score ?
Summary
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file).
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12275 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:06:11.138Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12275"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-20T03:39:49",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12275"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-10682",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12275",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12275"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-10682",
"datePublished": "2020-03-20T03:39:49",
"dateReserved": "2020-03-20T00:00:00",
"dateUpdated": "2024-08-04T11:06:11.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10085
Vulnerability from cvelistv5
Published
2018-04-13 05:00
Modified
2024-09-17 00:56
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:01.028Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \\lib\\classes\\internal\\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-13T05:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10085",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \\lib\\classes\\internal\\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10085",
"datePublished": "2018-04-13T05:00:00Z",
"dateReserved": "2018-04-13T00:00:00Z",
"dateUpdated": "2024-09-17T00:56:36.759Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-36408
Vulnerability from cvelistv5
Published
2021-07-02 17:51
Modified
2024-08-04 17:23
Severity ?
EPSS score ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12325 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:23:10.542Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Add Shortcut\" parameter under the \"Manage Shortcuts\" module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T17:51:33",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36408",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Add Shortcut\" parameter under the \"Manage Shortcuts\" module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12325",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36408",
"datePublished": "2021-07-02T17:51:33",
"dateReserved": "2021-07-01T00:00:00",
"dateUpdated": "2024-08-04T17:23:10.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-3883
Vulnerability from cvelistv5
Published
2010-10-08 20:00
Modified
2024-09-16 23:06
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications.
References
| ▼ | URL | Tags |
|---|---|---|
| http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/ | x_refsource_MISC | |
| http://secunia.com/advisories/40031 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:26:11.431Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
},
{
"name": "40031",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40031"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-10-08T20:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
},
{
"name": "40031",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40031"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-3883",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/",
"refsource": "MISC",
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
},
{
"name": "40031",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40031"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-3883",
"datePublished": "2010-10-08T20:00:00Z",
"dateReserved": "2010-10-08T00:00:00Z",
"dateUpdated": "2024-09-16T23:06:00.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-6071
Vulnerability from cvelistv5
Published
2017-02-21 07:46
Modified
2024-08-05 15:18
Severity ?
EPSS score ?
Summary
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.
References
| ▼ | URL | Tags |
|---|---|---|
| https://daylight-it.com/security-advisory-dlcs0001.html | x_refsource_MISC | |
| http://dev.cmsmadesimple.org/project/files/69 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:18:49.782Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-02-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-02-21T07:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6071",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://daylight-it.com/security-advisory-dlcs0001.html",
"refsource": "MISC",
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"name": "http://dev.cmsmadesimple.org/project/files/69",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/project/files/69"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-6071",
"datePublished": "2017-02-21T07:46:00",
"dateReserved": "2017-02-17T00:00:00",
"dateUpdated": "2024-08-05T15:18:49.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9060
Vulnerability from cvelistv5
Published
2021-09-17 15:47
Modified
2024-08-04 21:38
Severity ?
EPSS score ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1).
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | x_refsource_CONFIRM | |
| http://dev.cmsmadesimple.org/project/changelog/5819 | x_refsource_CONFIRM | |
| https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | x_refsource_CONFIRM | |
| https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.228Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5819"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-17T15:47:53",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5819"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9060",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"name": "http://dev.cmsmadesimple.org/project/changelog/5819",
"refsource": "CONFIRM",
"url": "http://dev.cmsmadesimple.org/project/changelog/5819"
},
{
"name": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg",
"refsource": "CONFIRM",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"name": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285",
"refsource": "CONFIRM",
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9060",
"datePublished": "2021-09-17T15:47:53",
"dateReserved": "2019-02-23T00:00:00",
"dateUpdated": "2024-08-04T21:38:46.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9693
Vulnerability from cvelistv5
Published
2019-03-11 18:00
Modified
2024-09-17 02:27
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id).
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:45.246Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php\u0026rev=47"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-11T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php\u0026rev=47"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9693",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285",
"refsource": "MISC",
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"name": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php\u0026rev=47",
"refsource": "MISC",
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php\u0026rev=47"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9693",
"datePublished": "2019-03-11T18:00:00Z",
"dateReserved": "2019-03-11T00:00:00Z",
"dateUpdated": "2024-09-17T02:27:36.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-11405
Vulnerability from cvelistv5
Published
2017-07-18 00:00
Modified
2024-09-16 23:00
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:05:30.578Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/filepickerimages/FilePicker_upload_vulnerability.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-18T00:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/filepickerimages/FilePicker_upload_vulnerability.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-11405",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/filepickerimages/FilePicker_upload_vulnerability.html",
"refsource": "MISC",
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/filepickerimages/FilePicker_upload_vulnerability.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-11405",
"datePublished": "2017-07-18T00:00:00Z",
"dateReserved": "2017-07-17T00:00:00Z",
"dateUpdated": "2024-09-16T23:00:22.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-6656
Vulnerability from cvelistv5
Published
2008-01-04 11:00
Modified
2024-08-07 16:18
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://forum.cmsmadesimple.org/index.php/topic%2C18240.0.html | x_refsource_CONFIRM | |
| http://osvdb.org/39788 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/27074 | vdb-entry, x_refsource_BID | |
| http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123/ | x_refsource_CONFIRM | |
| https://www.exploit-db.com/exploits/4810 | exploit, x_refsource_EXPLOIT-DB | |
| http://secunia.com/advisories/28285 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/39311 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T16:18:20.329Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://forum.cmsmadesimple.org/index.php/topic%2C18240.0.html"
},
{
"name": "39788",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/39788"
},
{
"name": "27074",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/27074"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123/"
},
{
"name": "4810",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/4810"
},
{
"name": "28285",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/28285"
},
{
"name": "tinymce-contentcss-sql-injection(39311)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39311"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-12-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-09-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://forum.cmsmadesimple.org/index.php/topic%2C18240.0.html"
},
{
"name": "39788",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/39788"
},
{
"name": "27074",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/27074"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123/"
},
{
"name": "4810",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/4810"
},
{
"name": "28285",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/28285"
},
{
"name": "tinymce-contentcss-sql-injection(39311)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39311"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-6656",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://forum.cmsmadesimple.org/index.php/topic,18240.0.html",
"refsource": "CONFIRM",
"url": "http://forum.cmsmadesimple.org/index.php/topic,18240.0.html"
},
{
"name": "39788",
"refsource": "OSVDB",
"url": "http://osvdb.org/39788"
},
{
"name": "27074",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/27074"
},
{
"name": "http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123/",
"refsource": "CONFIRM",
"url": "http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123/"
},
{
"name": "4810",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/4810"
},
{
"name": "28285",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28285"
},
{
"name": "tinymce-contentcss-sql-injection(39311)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39311"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-6656",
"datePublished": "2008-01-04T11:00:00",
"dateReserved": "2008-01-03T00:00:00",
"dateUpdated": "2024-08-07T16:18:20.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-7893
Vulnerability from cvelistv5
Published
2018-03-12 03:00
Modified
2024-08-05 06:37
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:37:59.631Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-03-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-12T02:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-7893",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md",
"refsource": "MISC",
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-7893",
"datePublished": "2018-03-12T03:00:00",
"dateReserved": "2018-03-09T00:00:00",
"dateUpdated": "2024-08-05T06:37:59.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-17629
Vulnerability from cvelistv5
Published
2019-10-16 12:24
Modified
2024-08-05 01:47
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
References
| ▼ | URL | Tags |
|---|---|---|
| https://forum.cmsmadesimple.org/viewforum.php?f=1 | x_refsource_MISC | |
| http://dev.cmsmadesimple.org/bug/view/12146 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:47:13.163Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12146"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the \"file manager \u003e upload images\" screen."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-16T12:24:10",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12146"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17629",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the \"file manager \u003e upload images\" screen."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://forum.cmsmadesimple.org/viewforum.php?f=1",
"refsource": "MISC",
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
},
{
"name": "http://dev.cmsmadesimple.org/bug/view/12146",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12146"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17629",
"datePublished": "2019-10-16T12:24:10",
"dateReserved": "2019-10-16T00:00:00",
"dateUpdated": "2024-08-05T01:47:13.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-36416
Vulnerability from cvelistv5
Published
2021-07-02 17:52
Modified
2024-08-04 17:30
Severity ?
EPSS score ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12325 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:30:06.890Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Create a new Design\" parameter under the \"Designs\" module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T17:52:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36416",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Create a new Design\" parameter under the \"Designs\" module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12325",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36416",
"datePublished": "2021-07-02T17:52:00",
"dateReserved": "2021-07-01T00:00:00",
"dateUpdated": "2024-08-04T17:30:06.890Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-28998
Vulnerability from cvelistv5
Published
2023-05-08 00:00
Modified
2025-01-29 14:51
Severity ?
EPSS score ?
Summary
File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T21:55:12.146Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://seclists.org/fulldisclosure/2021/Mar/50"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/file_upload_RCE/File_upload_to_RCE.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-28998",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T14:49:35.999225Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-29T14:51:27.978Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-05-08T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://seclists.org/fulldisclosure/2021/Mar/50"
},
{
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/file_upload_RCE/File_upload_to_RCE.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-28998",
"datePublished": "2023-05-08T00:00:00.000Z",
"dateReserved": "2021-03-22T00:00:00.000Z",
"dateUpdated": "2025-01-29T14:51:27.978Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-7256
Vulnerability from cvelistv5
Published
2017-03-24 15:00
Modified
2024-08-05 15:56
Severity ?
EPSS score ?
Summary
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.03i0.com/index.php/archives/113/ | x_refsource_MISC | |
| http://www.securityfocus.com/bid/97204 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:56:36.359Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"name": "97204",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/97204"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "XSS exists in the CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" feature via the m1_summary parameter. Someone must login to conduct the attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-30T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"name": "97204",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/97204"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-7256",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XSS exists in the CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" feature via the m1_summary parameter. Someone must login to conduct the attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.03i0.com/index.php/archives/113/",
"refsource": "MISC",
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"name": "97204",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97204"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-7256",
"datePublished": "2017-03-24T15:00:00",
"dateReserved": "2017-03-24T00:00:00",
"dateUpdated": "2024-08-05T15:56:36.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-19597
Vulnerability from cvelistv5
Published
2018-12-19 19:00
Modified
2024-08-05 11:37
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:37:11.565Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-11-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-02-20T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-19597",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf",
"refsource": "MISC",
"url": "https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-19597",
"datePublished": "2018-12-19T19:00:00",
"dateReserved": "2018-11-27T00:00:00",
"dateUpdated": "2024-08-05T11:37:11.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9056
Vulnerability from cvelistv5
Published
2019-04-11 19:26
Modified
2024-08-04 21:38
Severity ?
EPSS score ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | x_refsource_CONFIRM | |
| https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.289Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-11T19:26:42",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9056",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"name": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg",
"refsource": "CONFIRM",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9056",
"datePublished": "2019-04-11T19:26:42",
"dateReserved": "2019-02-23T00:00:00",
"dateUpdated": "2024-08-04T21:38:46.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-10681
Vulnerability from cvelistv5
Published
2020-03-20 03:39
Modified
2024-08-04 11:06
Severity ?
EPSS score ?
Summary
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12274 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:06:10.585Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12274"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-03-20T03:39:36",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12274"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-10681",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12274",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12274"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-10681",
"datePublished": "2020-03-20T03:39:36",
"dateReserved": "2020-03-20T00:00:00",
"dateUpdated": "2024-08-04T11:06:10.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2016-7904
Vulnerability from cvelistv5
Published
2017-01-16 06:00
Modified
2024-08-06 02:13
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2017/01/16/1 | x_refsource_MISC | |
| http://www.securityfocus.com/bid/95453 | vdb-entry, x_refsource_BID | |
| http://dev.cmsmadesimple.org/project/changelog/5392 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T02:13:20.497Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/16/1"
},
{
"name": "95453",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95453"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5392"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-01-17T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/16/1"
},
{
"name": "95453",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95453"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5392"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-7904",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.openwall.com/lists/oss-security/2017/01/16/1",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2017/01/16/1"
},
{
"name": "95453",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95453"
},
{
"name": "http://dev.cmsmadesimple.org/project/changelog/5392",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/project/changelog/5392"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-7904",
"datePublished": "2017-01-16T06:00:00",
"dateReserved": "2016-09-09T00:00:00",
"dateUpdated": "2024-08-06T02:13:20.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43339
Vulnerability from cvelistv5
Published
2023-09-25 00:00
Modified
2024-09-24 15:58
Severity ?
EPSS score ?
Summary
Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name, DataBase User or Database Port components.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.710Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "http://www.cmsmadesimple.org/"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/Cmsmadesimple-CMS-Stored-XSS/blob/main/README.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation/blob/main/README.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43339",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-24T15:57:55.339504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-24T15:58:07.857Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name, DataBase User or Database Port components."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-25T15:06:57.750634",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "http://www.cmsmadesimple.org/"
},
{
"url": "https://github.com/sromanhu/Cmsmadesimple-CMS-Stored-XSS/blob/main/README.md"
},
{
"url": "https://github.com/sromanhu/CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation/blob/main/README.md"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43339",
"datePublished": "2023-09-25T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-24T15:58:07.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-27377
Vulnerability from cvelistv5
Published
2021-06-01 14:57
Modified
2024-08-04 16:11
Severity ?
EPSS score ?
Summary
A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12317 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T16:11:36.606Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the \u0027Setting News\u0027 module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-01T14:57:20",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-27377",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the \u0027Setting News\u0027 module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12317",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-27377",
"datePublished": "2021-06-01T14:57:20",
"dateReserved": "2020-10-21T00:00:00",
"dateUpdated": "2024-08-04T16:11:36.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10521
Vulnerability from cvelistv5
Published
2018-04-27 18:00
Modified
2024-09-16 23:31
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cmsms_cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:39:08.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file move\" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-27T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10521",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file move\" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cmsms_cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10521",
"datePublished": "2018-04-27T18:00:00Z",
"dateReserved": "2018-04-27T00:00:00Z",
"dateUpdated": "2024-09-16T23:31:17.448Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-18270
Vulnerability from cvelistv5
Published
2018-10-12 19:00
Modified
2024-09-16 19:35
Severity ?
EPSS score ?
Summary
XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T11:08:20.354Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php \"Content--\u003eNews--\u003eAdd Article\" action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-12T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-18270",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php \"Content--\u003eNews--\u003eAdd Article\" action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12",
"refsource": "MISC",
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-18270",
"datePublished": "2018-10-12T19:00:00Z",
"dateReserved": "2018-10-12T00:00:00Z",
"dateUpdated": "2024-09-16T19:35:22.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-24860
Vulnerability from cvelistv5
Published
2020-10-01 13:55
Modified
2024-08-04 15:19
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org | x_refsource_MISC | |
| https://www.exploit-db.com/exploits/48851 | x_refsource_MISC | |
| https://www.youtube.com/watch?v=M6D7DmmjLak&t=22s | x_refsource_MISC | |
| http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T15:19:09.387Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/48851"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.youtube.com/watch?v=M6D7DmmjLak\u0026t=22s"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-10-01T16:06:37",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cmsmadesimple.org"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.exploit-db.com/exploits/48851"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.youtube.com/watch?v=M6D7DmmjLak\u0026t=22s"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-24860",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org",
"refsource": "MISC",
"url": "https://www.cmsmadesimple.org"
},
{
"name": "https://www.exploit-db.com/exploits/48851",
"refsource": "MISC",
"url": "https://www.exploit-db.com/exploits/48851"
},
{
"name": "https://www.youtube.com/watch?v=M6D7DmmjLak\u0026t=22s",
"refsource": "MISC",
"url": "https://www.youtube.com/watch?v=M6D7DmmjLak\u0026t=22s"
},
{
"name": "http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-24860",
"datePublished": "2020-10-01T13:55:24",
"dateReserved": "2020-08-28T00:00:00",
"dateUpdated": "2024-08-04T15:19:09.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10032
Vulnerability from cvelistv5
Published
2018-04-11 19:00
Modified
2024-09-16 18:14
Severity ?
EPSS score ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/zxyxx/cmsms_vul | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:00.696Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-11T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10032",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zxyxx/cmsms_vul",
"refsource": "MISC",
"url": "https://github.com/zxyxx/cmsms_vul"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10032",
"datePublished": "2018-04-11T19:00:00Z",
"dateReserved": "2018-04-11T00:00:00Z",
"dateUpdated": "2024-09-16T18:14:12.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10517
Vulnerability from cvelistv5
Published
2018-04-27 18:00
Modified
2024-08-05 07:39
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cmsms_cve/blob/master/README.md | x_refsource_MISC | |
| https://www.exploit-db.com/exploits/45793/ | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:39:08.207Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"name": "45793",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/45793/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"module import\" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-11-08T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"name": "45793",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/45793/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10517",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"module import\" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cmsms_cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"name": "45793",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/45793/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10517",
"datePublished": "2018-04-27T18:00:00",
"dateReserved": "2018-04-27T00:00:00",
"dateUpdated": "2024-08-05T07:39:08.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-16783
Vulnerability from cvelistv5
Published
2017-11-10 23:00
Modified
2024-08-05 20:35
Severity ?
EPSS score ?
Summary
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:35:21.161Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-032-server-side-template-injection-vulnerability-in-cms-made-simple/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/159690/CMS-Made-Simple-2.1.6-Server-Side-Template-Injection.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-11-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-10-26T17:08:52",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-032-server-side-template-injection-vulnerability-in-cms-made-simple/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/159690/CMS-Made-Simple-2.1.6-Server-Side-Template-Injection.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-16783",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.netsparker.com/web-applications-advisories/ns-17-032-server-side-template-injection-vulnerability-in-cms-made-simple/",
"refsource": "MISC",
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-032-server-side-template-injection-vulnerability-in-cms-made-simple/"
},
{
"name": "http://packetstormsecurity.com/files/159690/CMS-Made-Simple-2.1.6-Server-Side-Template-Injection.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/159690/CMS-Made-Simple-2.1.6-Server-Side-Template-Injection.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-16783",
"datePublished": "2017-11-10T23:00:00",
"dateReserved": "2017-11-10T00:00:00",
"dateUpdated": "2024-08-05T20:35:21.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-1000453
Vulnerability from cvelistv5
Published
2018-01-02 17:00
Modified
2024-09-16 23:02
Severity ?
EPSS score ?
Summary
CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/ | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T22:00:41.531Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2017-12-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-01-02T17:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2017-12-29",
"ID": "CVE-2017-1000453",
"REQUESTER": "m.daniel.legall@gmail.com",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/",
"refsource": "MISC",
"url": "https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-1000453",
"datePublished": "2018-01-02T17:00:00Z",
"dateReserved": "2018-01-02T00:00:00Z",
"dateUpdated": "2024-09-16T23:02:01.655Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10516
Vulnerability from cvelistv5
Published
2018-04-27 18:00
Modified
2024-09-17 01:15
Severity ?
EPSS score ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cmsms_cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:39:08.274Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file rename\" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-27T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10516",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file rename\" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cmsms_cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10516",
"datePublished": "2018-04-27T18:00:00Z",
"dateReserved": "2018-04-27T00:00:00Z",
"dateUpdated": "2024-09-17T01:15:37.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-3929
Vulnerability from cvelistv5
Published
2013-12-09 16:00
Modified
2024-08-06 16:22
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/53920 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:22:01.548Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "53920",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/53920"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-12-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the \"Modify Events\" permission to inject arbitrary web script or HTML via the handler parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-12-09T15:57:00",
"orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"shortName": "flexera"
},
"references": [
{
"name": "53920",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/53920"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
"ID": "CVE-2013-3929",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the \"Modify Events\" permission to inject arbitrary web script or HTML via the handler parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "53920",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/53920"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
"assignerShortName": "flexera",
"cveId": "CVE-2013-3929",
"datePublished": "2013-12-09T16:00:00",
"dateReserved": "2013-06-04T00:00:00",
"dateUpdated": "2024-08-06T16:22:01.548Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9692
Vulnerability from cvelistv5
Published
2019-03-11 18:00
Modified
2024-08-04 21:54
Severity ?
EPSS score ?
Summary
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).
References
| ▼ | URL | Tags |
|---|---|---|
| http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php&rev=47 | x_refsource_MISC | |
| https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285 | x_refsource_MISC | |
| https://www.exploit-db.com/exploits/46546/ | exploit, x_refsource_EXPLOIT-DB | |
| http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html | x_refsource_MISC | |
| http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce | x_refsource_MISC | |
| https://www.exploit-db.com/exploits/46627/ | exploit, x_refsource_EXPLOIT-DB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:54:45.062Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php\u0026rev=47"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"name": "46546",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/46546/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce"
},
{
"name": "46627",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/46627/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-03-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-28T18:06:09",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php\u0026rev=47"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"name": "46546",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/46546/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce"
},
{
"name": "46627",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/46627/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9692",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php\u0026rev=47",
"refsource": "MISC",
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php\u0026rev=47"
},
{
"name": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285",
"refsource": "MISC",
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"name": "46546",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/46546/"
},
{
"name": "http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html"
},
{
"name": "http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce",
"refsource": "MISC",
"url": "http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce"
},
{
"name": "46627",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/46627/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9692",
"datePublished": "2019-03-11T18:00:00",
"dateReserved": "2019-03-11T00:00:00",
"dateUpdated": "2024-08-04T21:54:45.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-10107
Vulnerability from cvelistv5
Published
2019-03-26 21:52
Modified
2024-08-04 22:10
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12003 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:10:09.933Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12003"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has XSS via the myaccount.php \"Email Address\" field, which is reachable via the \"My Preferences -\u003e My Account\" section."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-26T21:52:45",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12003"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-10107",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.10 has XSS via the myaccount.php \"Email Address\" field, which is reachable via the \"My Preferences -\u003e My Account\" section."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12003",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12003"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-10107",
"datePublished": "2019-03-26T21:52:45",
"dateReserved": "2019-03-26T00:00:00",
"dateUpdated": "2024-08-04T22:10:09.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10519
Vulnerability from cvelistv5
Published
2018-04-27 18:00
Modified
2024-09-16 20:47
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cmsms_cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:39:07.998Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this-\u003e_loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-27T18:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10519",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this-\u003e_loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cmsms_cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10519",
"datePublished": "2018-04-27T18:00:00Z",
"dateReserved": "2018-04-27T00:00:00Z",
"dateUpdated": "2024-09-16T20:47:50.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43360
Vulnerability from cvelistv5
Published
2023-10-24 00:00
Modified
2024-09-11 18:19
Severity ?
EPSS score ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.985Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CMSmadesimple-Stored-XSS---File-Picker-extension"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43360",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-11T18:19:09.388762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-11T18:19:27.553Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-24T22:57:26.973031",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CMSmadesimple-Stored-XSS---File-Picker-extension"
},
{
"url": "https://github.com/sromanhu/CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43360",
"datePublished": "2023-10-24T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-11T18:19:27.553Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-11226
Vulnerability from cvelistv5
Published
2019-06-05 17:56
Modified
2024-08-04 22:48
Severity ?
EPSS score ?
Summary
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
References
| ▼ | URL | Tags |
|---|---|---|
| http://seclists.org/fulldisclosure/2019/May/36 | mailing-list, x_refsource_FULLDISC | |
| http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html | x_refsource_MISC | |
| https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:48:08.995Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190524 CMS Made Simple 2.2.10 - (Authenticated) Persistent Cross-Site Scripting",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2019/May/36"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has XSS via the m1_name parameter in \"Add Article\" under Content -\u003e Content Manager -\u003e News."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-06-05T17:56:36",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20190524 CMS Made Simple 2.2.10 - (Authenticated) Persistent Cross-Site Scripting",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2019/May/36"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11226",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 2.2.10 has XSS via the m1_name parameter in \"Add Article\" under Content -\u003e Content Manager -\u003e News."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190524 CMS Made Simple 2.2.10 - (Authenticated) Persistent Cross-Site Scripting",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2019/May/36"
},
{
"name": "http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html"
},
{
"name": "https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226",
"refsource": "MISC",
"url": "https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11226",
"datePublished": "2019-06-05T17:56:04",
"dateReserved": "2019-04-12T00:00:00",
"dateUpdated": "2024-08-04T22:48:08.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-5442
Vulnerability from cvelistv5
Published
2007-10-14 18:00
Modified
2024-08-07 15:31
Severity ?
EPSS score ?
Summary
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/archive/1/481984/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/3223 | third-party-advisory, x_refsource_SREASON |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T15:31:58.141Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "3223",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3223"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-10-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-15T20:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "3223",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3223"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-5442",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20071010 Several vulnerabilities in CMS Made Simple 1.1.3.1",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"name": "3223",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3223"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-5442",
"datePublished": "2007-10-14T18:00:00",
"dateReserved": "2007-10-14T00:00:00",
"dateUpdated": "2024-08-07T15:31:58.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-4663
Vulnerability from cvelistv5
Published
2011-06-08 10:00
Modified
2024-09-17 01:30
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://openwall.com/lists/oss-security/2011/03/30/9 | mailing-list, x_refsource_MLIST | |
| http://openwall.com/lists/oss-security/2011/03/29/2 | mailing-list, x_refsource_MLIST | |
| http://forum.cmsmadesimple.org/viewtopic.php?t=49245 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T03:51:18.015Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20110330 Re: CVE request: cmsmadesimple before 1.9.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/03/30/9"
},
{
"name": "[oss-security] 20110329 CVE request: cmsmadesimple before 1.9.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2011/03/29/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?t=49245"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-06-08T10:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20110330 Re: CVE request: cmsmadesimple before 1.9.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/03/30/9"
},
{
"name": "[oss-security] 20110329 CVE request: cmsmadesimple before 1.9.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2011/03/29/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?t=49245"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2010-4663",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20110330 Re: CVE request: cmsmadesimple before 1.9.1",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2011/03/30/9"
},
{
"name": "[oss-security] 20110329 CVE request: cmsmadesimple before 1.9.1",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2011/03/29/2"
},
{
"name": "http://forum.cmsmadesimple.org/viewtopic.php?t=49245",
"refsource": "CONFIRM",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?t=49245"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-4663",
"datePublished": "2011-06-08T10:00:00Z",
"dateReserved": "2011-01-03T00:00:00Z",
"dateUpdated": "2024-09-17T01:30:47.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3718
Vulnerability from cvelistv5
Published
2011-09-23 23:00
Modified
2024-09-17 03:18
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444.
References
| ▼ | URL | Tags |
|---|---|---|
| http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cmsmadesimple-1.9.2 | x_refsource_MISC | |
| http://www.openwall.com/lists/oss-security/2011/06/27/6 | mailing-list, x_refsource_MLIST | |
| http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:46:02.603Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cmsmadesimple-1.9.2"
},
{
"name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-09-23T23:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cmsmadesimple-1.9.2"
},
{
"name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3718",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cmsmadesimple-1.9.2",
"refsource": "MISC",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cmsmadesimple-1.9.2"
},
{
"name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README",
"refsource": "MISC",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3718",
"datePublished": "2011-09-23T23:00:00Z",
"dateReserved": "2011-09-23T00:00:00Z",
"dateUpdated": "2024-09-17T03:18:21.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-6555
Vulnerability from cvelistv5
Published
2017-03-09 09:26
Modified
2024-08-05 15:33
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka "Design Manager > Categories > Category Description").
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.daimacn.com/?id=7 | x_refsource_MISC | |
| http://www.securityfocus.com/bid/96933 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:33:20.187Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.daimacn.com/?id=7"
},
{
"name": "96933",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96933"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka \"Design Manager \u003e Categories \u003e Category Description\")."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-17T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.daimacn.com/?id=7"
},
{
"name": "96933",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96933"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6555",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka \"Design Manager \u003e Categories \u003e Category Description\")."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.daimacn.com/?id=7",
"refsource": "MISC",
"url": "http://www.daimacn.com/?id=7"
},
{
"name": "96933",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96933"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-6555",
"datePublished": "2017-03-09T09:26:00",
"dateReserved": "2017-03-09T00:00:00",
"dateUpdated": "2024-08-05T15:33:20.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-6064
Vulnerability from cvelistv5
Published
2012-12-03 21:00
Modified
2024-08-06 21:21
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html | x_refsource_MISC | |
| https://www.htbridge.com/advisory/HTB23121 | x_refsource_MISC | |
| http://secunia.com/advisories/51185 | third-party-advisory, x_refsource_SECUNIA | |
| http://forum.cmsmadesimple.org/viewtopic.php?f=1&t=63545 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/79881 | vdb-entry, x_refsource_XF | |
| http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple&path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php&rev=8400&peg=8498 | x_refsource_CONFIRM | |
| http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:21:28.835Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.htbridge.com/advisory/HTB23121"
},
{
"name": "51185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/51185"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"name": "cmsmadesimple-images-csrf(79881)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"name": "20121107 Cross-Site Request Forgery (CSRF) in CMS Made Simple",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-11-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.htbridge.com/advisory/HTB23121"
},
{
"name": "51185",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/51185"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"name": "cmsmadesimple-images-csrf(79881)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"name": "20121107 Cross-Site Request Forgery (CSRF) in CMS Made Simple",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-6064",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"name": "https://www.htbridge.com/advisory/HTB23121",
"refsource": "MISC",
"url": "https://www.htbridge.com/advisory/HTB23121"
},
{
"name": "51185",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/51185"
},
{
"name": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545",
"refsource": "CONFIRM",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"name": "cmsmadesimple-images-csrf(79881)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"name": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498",
"refsource": "CONFIRM",
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"name": "20121107 Cross-Site Request Forgery (CSRF) in CMS Made Simple",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-6064",
"datePublished": "2012-12-03T21:00:00",
"dateReserved": "2012-12-03T00:00:00",
"dateUpdated": "2024-08-06T21:21:28.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2023-43354
Vulnerability from cvelistv5
Published
2023-10-20 00:00
Modified
2024-09-12 14:56
Severity ?
EPSS score ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:37:23.776Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/sromanhu/CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-43354",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T14:56:38.713712Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T14:56:56.384Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T21:35:10.813103",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/sromanhu/CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-43354",
"datePublished": "2023-10-20T00:00:00",
"dateReserved": "2023-09-18T00:00:00",
"dateUpdated": "2024-09-12T14:56:56.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2014-0334
Vulnerability from cvelistv5
Published
2014-03-02 17:00
Modified
2024-08-06 09:13
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/65898 | vdb-entry, x_refsource_BID | |
| http://www.kb.cert.org/vuls/id/526062 | third-party-advisory, x_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:13:09.747Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "65898",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65898"
},
{
"name": "VU#526062",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/526062"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-02-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2015-06-02T14:57:00",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "65898",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65898"
},
{
"name": "VU#526062",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/526062"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2014-0334",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "65898",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/65898"
},
{
"name": "VU#526062",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/526062"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2014-0334",
"datePublished": "2014-03-02T17:00:00",
"dateReserved": "2013-12-05T00:00:00",
"dateUpdated": "2024-08-06T09:13:09.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-7448
Vulnerability from cvelistv5
Published
2018-02-26 17:00
Modified
2024-08-05 06:24
Severity ?
EPSS score ?
Summary
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.exploit-db.com/exploits/44192/ | exploit, x_refsource_EXPLOIT-DB | |
| https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html | x_refsource_MISC | |
| http://dev.cmsmadesimple.org/project/changelog/5471 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:24:12.042Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "44192",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44192/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5471"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-02-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the \"timezone\" parameter in step 4 of a fresh installation procedure."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-01T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "44192",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44192/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5471"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-7448",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the \"timezone\" parameter in step 4 of a fresh installation procedure."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "44192",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44192/"
},
{
"name": "https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html",
"refsource": "MISC",
"url": "https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html"
},
{
"name": "http://dev.cmsmadesimple.org/project/changelog/5471",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/project/changelog/5471"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-7448",
"datePublished": "2018-02-26T17:00:00",
"dateReserved": "2018-02-23T00:00:00",
"dateUpdated": "2024-08-05T06:24:12.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-11513
Vulnerability from cvelistv5
Published
2019-04-25 02:52
Modified
2024-08-04 22:55
Severity ?
EPSS score ?
Summary
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12022 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T22:55:40.576Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12022"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the \"New name\" field in a Rename action."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-04-25T02:52:28",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12022"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-11513",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the \"New name\" field in a Rename action."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12022",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12022"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-11513",
"datePublished": "2019-04-25T02:52:28",
"dateReserved": "2019-04-24T00:00:00",
"dateUpdated": "2024-08-04T22:55:40.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9061
Vulnerability from cvelistv5
Published
2019-03-26 16:49
Modified
2024-08-04 21:38
Severity ?
EPSS score ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | x_refsource_CONFIRM | |
| https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:46.407Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the \"install module\" feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-26T16:49:42",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9061",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the \"install module\" feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"name": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg",
"refsource": "MISC",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9061",
"datePublished": "2019-03-26T16:49:42",
"dateReserved": "2019-02-23T00:00:00",
"dateUpdated": "2024-08-04T21:38:46.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1000094
Vulnerability from cvelistv5
Published
2018-03-13 01:00
Modified
2024-08-05 12:33
Severity ?
EPSS score ?
Summary
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.exploit-db.com/exploits/44976/ | exploit, x_refsource_EXPLOIT-DB | |
| http://dev.cmsmadesimple.org/bug/view/11741 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:33:49.217Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "44976",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44976/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11741"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"dateAssigned": "2018-02-20T00:00:00",
"datePublic": "2018-03-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -\u003e copy to any extension."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-06T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "44976",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44976/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11741"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"DATE_ASSIGNED": "2/20/2018 19:45:25",
"ID": "CVE-2018-1000094",
"REQUESTER": "strukt93@gmail.com",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -\u003e copy to any extension."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "44976",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44976/"
},
{
"name": "http://dev.cmsmadesimple.org/bug/view/11741",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/11741"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-1000094",
"datePublished": "2018-03-13T01:00:00",
"dateReserved": "2018-03-12T00:00:00",
"dateUpdated": "2024-08-05T12:33:49.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10030
Vulnerability from cvelistv5
Published
2018-04-11 19:00
Modified
2024-09-17 04:08
Severity ?
EPSS score ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/zxyxx/cmsms_vul | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:00.874Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-11T19:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10030",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/zxyxx/cmsms_vul",
"refsource": "MISC",
"url": "https://github.com/zxyxx/cmsms_vul"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10030",
"datePublished": "2018-04-11T19:00:00Z",
"dateReserved": "2018-04-11T00:00:00Z",
"dateUpdated": "2024-09-17T04:08:54.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-17735
Vulnerability from cvelistv5
Published
2017-12-18 06:00
Modified
2024-09-16 16:14
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.
References
| ▼ | URL | Tags |
|---|---|---|
| https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737 | x_refsource_CONFIRM | |
| https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:59:17.705Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-18T06:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-17735",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737",
"refsource": "CONFIRM",
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"name": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-17735",
"datePublished": "2017-12-18T06:00:00Z",
"dateReserved": "2017-12-18T00:00:00Z",
"dateUpdated": "2024-09-16T16:14:07.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9057
Vulnerability from cvelistv5
Published
2019-03-26 16:34
Modified
2024-08-04 21:38
Severity ?
EPSS score ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | x_refsource_CONFIRM | |
| https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:45.678Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-26T16:34:22",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9057",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"name": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg",
"refsource": "MISC",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9057",
"datePublished": "2019-03-26T16:34:22",
"dateReserved": "2019-02-23T00:00:00",
"dateUpdated": "2024-08-04T21:38:45.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-9059
Vulnerability from cvelistv5
Published
2019-03-26 16:45
Modified
2024-08-04 21:38
Severity ?
EPSS score ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | x_refsource_CONFIRM | |
| https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:38:45.645Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-03-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting \"sendmail\" in the \"Mailer\" option, and launching the \"Forgot your password\" feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-03-26T16:45:38",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-9059",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting \"sendmail\" in the \"Mailer\" option, and launching the \"Forgot your password\" feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"name": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg",
"refsource": "MISC",
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-9059",
"datePublished": "2019-03-26T16:45:38",
"dateReserved": "2019-02-23T00:00:00",
"dateUpdated": "2024-08-04T21:38:45.645Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2017-17734
Vulnerability from cvelistv5
Published
2017-12-18 06:00
Modified
2024-09-16 19:19
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.
References
| ▼ | URL | Tags |
|---|---|---|
| https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737 | x_refsource_CONFIRM | |
| https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T20:59:17.615Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-18T06:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-17734",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737",
"refsource": "CONFIRM",
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"name": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa",
"refsource": "CONFIRM",
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-17734",
"datePublished": "2017-12-18T06:00:00Z",
"dateReserved": "2017-12-18T00:00:00Z",
"dateUpdated": "2024-09-16T19:19:33.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-22842
Vulnerability from cvelistv5
Published
2020-09-30 03:12
Modified
2024-08-04 14:51
Severity ?
EPSS score ?
Summary
CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12291 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:51:10.796Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12291"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-09-30T03:12:33",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12291"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-22842",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12291",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12291"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-22842",
"datePublished": "2020-09-30T03:12:33",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:51:10.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-23240
Vulnerability from cvelistv5
Published
2021-07-26 20:06
Modified
2024-08-04 14:58
Severity ?
EPSS score ?
Summary
Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12321 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T14:58:14.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12321"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-26T20:06:58",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12321"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-23240",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12321",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12321"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-23240",
"datePublished": "2021-07-26T20:06:58",
"dateReserved": "2020-08-13T00:00:00",
"dateUpdated": "2024-08-04T14:58:14.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10083
Vulnerability from cvelistv5
Published
2018-04-13 05:00
Modified
2024-09-17 02:56
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:01.063Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\\FilePicker does not restrict the val parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-13T05:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10083",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\\FilePicker does not restrict the val parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10083",
"datePublished": "2018-04-13T05:00:00Z",
"dateReserved": "2018-04-13T00:00:00Z",
"dateUpdated": "2024-09-17T02:56:33.197Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-10084
Vulnerability from cvelistv5
Published
2018-04-13 05:00
Modified
2024-09-16 17:23
Severity ?
EPSS score ?
Summary
CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/itodaro/cve/blob/master/README.md | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:32:01.141Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this-\u003e_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-13T05:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-10084",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this-\u003e_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/itodaro/cve/blob/master/README.md",
"refsource": "MISC",
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-10084",
"datePublished": "2018-04-13T05:00:00Z",
"dateReserved": "2018-04-13T00:00:00Z",
"dateUpdated": "2024-09-16T17:23:04.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-36410
Vulnerability from cvelistv5
Published
2021-07-02 17:51
Modified
2024-08-04 17:23
Severity ?
EPSS score ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://dev.cmsmadesimple.org/bug/view/12325 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T17:23:10.533Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Email address to receive notification of news submission\" parameter under the \"Options\" module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-02T17:51:36",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-36410",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Email address to receive notification of news submission\" parameter under the \"Options\" module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://dev.cmsmadesimple.org/bug/view/12325",
"refsource": "MISC",
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-36410",
"datePublished": "2021-07-02T17:51:36",
"dateReserved": "2021-07-01T00:00:00",
"dateUpdated": "2024-08-04T17:23:10.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-3083
Vulnerability from cvelistv5
Published
2005-09-27 04:00
Modified
2024-08-07 23:01
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=112785315518373&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/14937 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:01:57.562Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20050926 CMS Made Simple 0.10 is susceptible to a cross site scripting attack.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112785315518373\u0026w=2"
},
{
"name": "14937",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/14937"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-09-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20050926 CMS Made Simple 0.10 is susceptible to a cross site scripting attack.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112785315518373\u0026w=2"
},
{
"name": "14937",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/14937"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3083",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20050926 CMS Made Simple 0.10 is susceptible to a cross site scripting attack.",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=112785315518373\u0026w=2"
},
{
"name": "14937",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14937"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3083",
"datePublished": "2005-09-27T04:00:00",
"dateReserved": "2005-09-27T00:00:00",
"dateUpdated": "2024-08-07T23:01:57.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2020-10-01 14:15
Modified
2024-11-21 05:16
Severity ?
Summary
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.cmsmadesimple.org | Product | |
| cve@mitre.org | https://www.exploit-db.com/exploits/48851 | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.youtube.com/watch?v=M6D7DmmjLak&t=22s | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/48851 | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.youtube.com/watch?v=M6D7DmmjLak&t=22s | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website."
},
{
"lang": "es",
"value": "CMS Made Simple versi\u00f3n 2.2.14, permite a un usuario autenticado con acceso al Content Manager editar el contenido y colocar la carga \u00fatil de tipo XSS persistente en los campos de texto afectados.\u0026#xa0;El usuario puede obtener cookies de cada usuario autenticado que visita el sitio web"
}
],
"id": "CVE-2020-24860",
"lastModified": "2024-11-21T05:16:08.420",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-10-01T14:15:15.223",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "https://www.cmsmadesimple.org"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/48851"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.youtube.com/watch?v=M6D7DmmjLak\u0026t=22s"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/159434/CMS-Made-Simple-2.2.14-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "https://www.cmsmadesimple.org"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/48851"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.youtube.com/watch?v=M6D7DmmjLak\u0026t=22s"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-05-28 19:15
Modified
2024-11-21 05:01
Severity ?
Summary
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12312 | Vendor Advisory | |
| cve@mitre.org | https://www.youtube.com/watch?v=Q6RMhmpScho | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12312 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.youtube.com/watch?v=Q6RMhmpScho | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A1E405D4-A612-4448-9C8E-6C311FBF98A7",
"versionEndIncluding": "2.2.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name."
},
{
"lang": "es",
"value": "CMS Made Simple versiones hasta 2.2.14, permite un ataque de tipo XSS por medio de un nombre de perfil de File Picker."
}
],
"id": "CVE-2020-13660",
"lastModified": "2024-11-21T05:01:42.703",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-05-28T19:15:11.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12312"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.youtube.com/watch?v=Q6RMhmpScho"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12312"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.youtube.com/watch?v=Q6RMhmpScho"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-03-02 17:55
Modified
2024-11-21 02:05
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.11.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.10:*:*:*:*:*:*:*",
"matchCriteriaId": "11DBE7DB-344E-4085-ABA4-E8058948B69B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en lib/filemanager/ImageManager/editorFrame.php en CMS Made Simple 1.11.10 permite a atacantes remotos inyectar script Web o HTML arbitrarios a trav\u00e9s del par\u00e1metro action, un problema diferente a CVE-2014-0334. NOTA: la divulgaci\u00f3n original tambi\u00e9n inform\u00f3 de problemas que pueden no cruzar l\u00edmites de privilegio."
}
],
"id": "CVE-2014-2092",
"lastModified": "2024-11-21T02:05:38.370",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-03-02T17:55:03.067",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/65746"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/65746"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-12-31 05:00
Modified
2024-11-21 00:23
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the optional user comment module in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the user comment form.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the optional user comment module in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the user comment form."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el m\u00f3dulo opcional de comentario de usuario en el CMS Made Simple 1.0.2 permite a un atacante remoto inyectar secuencias de comandos web o HTML a trav\u00e9s del formulario de comentario del usuario."
}
],
"id": "CVE-2006-6844",
"lastModified": "2024-11-21T00:23:46.973",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2087"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1017445"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.l0j1k.com/security/CMSMadeSimple_1.0.2_25Dec06.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/455306/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/21756"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2087"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1017445"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.l0j1k.com/security/CMSMadeSimple_1.0.2_25Dec06.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/455306/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/21756"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-12-18 06:29
Modified
2024-11-21 03:18
Severity ?
Summary
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa | Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F5942A21-0255-482E-896C-E6248A3C93C2",
"versionEndExcluding": "2.2.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) en versiones anteriores a la 2.2.5 no almacena en cach\u00e9 correctamente la informaci\u00f3n de inicio de sesi\u00f3n en las cookies."
}
],
"id": "CVE-2017-17735",
"lastModified": "2024-11-21T03:18:33.027",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-12-18T06:29:00.240",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-06-08 10:36
Modified
2024-11-21 01:21
Severity ?
Summary
Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2E4C0844-4D2C-46E4-8724-0536AC736901",
"versionEndIncluding": "1.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BE0143D1-03F2-497B-A24D-8C989C10EFBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8B36B7B1-8A62-4A2D-A0E3-360DC56CE661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6F57C668-24A4-4E57-8737-71DD84356986",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BFDA54CA-3D5B-4D30-864B-B4227961FABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA4D26A-0FA0-4998-B8EB-23BAE3C4B6A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA77F1-B40F-4DC5-AD48-4EA403E691C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "FD39CD3A-0982-4BA3-A965-56BA06EDE972",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "262B4547-CAEB-44A0-AB42-8D51C06DC0B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B7F4228D-8EEA-49B5-B3A2-2298477BB830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1AB6A475-ADAC-4C31-9C27-C32E79E65A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "41E3BC7F-E4CD-410F-90E9-BE3352846FE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DE089F0E-CEAC-45C2-9F50-9DDDA77BA16C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C39AFF8F-8D83-4E41-BFA6-0DB4C76AB2C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05DDCE27-5140-4D88-A9BF-9D77DF0D1B7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "81464454-2834-4387-9093-679EC9F57A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98904F65-B481-455F-BF9B-CDFF8B0964B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3DDCBA15-205B-4879-8B64-F3264FD097E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2056E4B7-2528-40A4-B28E-8E4FB3E6361F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "02FEC8DD-413B-4669-BEBF-C62B9A79D70E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "418CD161-9F55-4631-A08C-08A9CF05CEC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F38D4B6-A255-4AAC-8AFF-DAB97C1B558F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "192B8763-CB7B-45AB-A5AD-1B9675CF8D06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9A313016-9EC8-4AE0-A880-D95A17BA990B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8AB70F8F-F931-4AFC-8C5C-D1A56BDA63B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3690E06D-394E-44BC-9929-B17B2734D80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AAED3443-D64D-4FF6-851C-90A99F61CCC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4D76634F-6DC4-49CD-8060-21F2ED17F652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C0FBFCAD-8850-4804-9B2A-566FDDE39685",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C94DE9A2-E9AA-43BC-8D1F-EFA97722C482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0DCBA3A6-3776-470D-BFC7-E4836D2A586F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7F327F-CA20-47C1-BF99-AB4A439EAB07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "04796760-3ED2-4B65-B571-6685916A8130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B5C6034-A597-41A6-9F1A-F3DAB63DF31C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9FE3B4A8-9C8A-46D2-A8EB-49FD3533ED3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B4AA57A0-804A-4008-A131-0DF259A5515F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "8E3417F0-EBAF-405E-A26E-F3EA570A0447",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "38CCB2E6-7722-4F23-AEF4-E720D1D63801",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98D93656-A4D2-44C4-82EC-55C8BE1A7304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BAEAE47F-5A26-474E-8F7F-72976A8FEBA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E188A80A-980F-4AD8-B3B8-21D303121F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E730A3A8-8A60-4CC5-B167-26984DE0DA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA19F5B2-7C5C-43DD-85ED-E2CD4EF6E748",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "778E5678-B763-415E-AA35-EF644E7A2CD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7DEC1EBC-1DBA-4350-8B34-7A872C62B6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "078B102C-748B-4847-8413-71659982AF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F8649F4-1A33-41AE-888F-2D6BB19BCB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "206B72EC-895E-4DA0-B41B-AAE41E53C108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC131029-CE9C-437E-B3D3-7924062E14D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF34A817-09AC-4C7E-916B-1B158C5EE599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20E8FFE1-9431-4146-AFD3-5491F5FE3C23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1016173-D980-4909-86C0-81C94711FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "068BF668-9626-4CA4-A401-1946DCF916AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA029BD9-1025-4802-BAE2-BEE218715FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9928102A-27E2-4604-93F4-318BA7CDCAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1EECFB4-7001-411F-BBAE-BABD5248E4B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40C6F2FA-0518-4B2A-9F05-51897A16AF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A35145EB-E7A7-48EC-91A9-9D423F316712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "589C199E-12F9-41CF-BFE0-4B952B773460",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7BB9992D-2EF4-4DBF-898A-6284A074403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2F14D3BD-5835-4206-BE44-72F31F46D067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "61F2E017-EEBD-473F-A15A-FD7B52A74E5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EE7E3436-2FF9-4DC6-A552-A46330220AF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C5A4D84-4C6D-453D-B1D3-2445DD7213C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC3F038-4441-4409-9384-26565F6385EB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en el m\u00f3dulo News en CMS Made Simple (CMSMS) anterior a v1.9.1 tiene un impacto desconocido y vectores de ataque."
}
],
"id": "CVE-2010-4663",
"lastModified": "2024-11-21T01:21:28.083",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-06-08T10:36:13.027",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?t=49245"
},
{
"source": "secalert@redhat.com",
"url": "http://openwall.com/lists/oss-security/2011/03/29/2"
},
{
"source": "secalert@redhat.com",
"url": "http://openwall.com/lists/oss-security/2011/03/30/9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://forum.cmsmadesimple.org/viewtopic.php?t=49245"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2011/03/29/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://openwall.com/lists/oss-security/2011/03/30/9"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-03-20 04:15
Modified
2024-11-21 04:55
Severity ?
Summary
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12274 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12274 | Exploit, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.13 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E4E89FAB-60D7-4AF3-B35F-EB52E7D8D135",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php."
},
{
"lang": "es",
"value": "Filemanager en CMS Made Simple versi\u00f3n 2.2.13, presenta una vulnerabilidad de tipo XSS almacenado, por medio de un archivo .pxd, como es demostrado por el par\u00e1metro m1_files[] en el archivo admin/moduleinterface.php."
}
],
"id": "CVE-2020-10681",
"lastModified": "2024-11-21T04:55:50.297",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-20T04:15:15.960",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12274"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12274"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-02-28 23:15
Modified
2024-11-21 06:49
Severity ?
Summary
CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12503 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12503 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.15 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "47371FA0-89B6-4625-B43D-AFC56252F4CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage."
},
{
"lang": "es",
"value": "Se ha detectado que CMS Made Simple versi\u00f3n v2.2.15, contiene una vulnerabilidad de tipo cross-site scripting (XSS) reflejado por medio del par\u00e1metro m1_fmmessage."
}
],
"id": "CVE-2022-23907",
"lastModified": "2024-11-21T06:49:26.623",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-02-28T23:15:12.520",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12503"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12503"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-13 01:29
Modified
2024-11-21 03:39
Severity ?
Summary
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/11741 | Exploit, Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://www.exploit-db.com/exploits/44976/ | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/11741 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/44976/ | Exploit, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB7ED7E9-D2F9-416D-B33C-C6113C1E331E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -\u003e copy to any extension."
},
{
"lang": "es",
"value": "CMS Made Simple 2.2.5 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en File Manager que podr\u00eda permitir que un administrador autenticado con acceso al gestor de archivos ejecute c\u00f3digo en el servidor. El ataque parece ser explotable mediante File upload -\u003e copy a cualquier extensi\u00f3n."
}
],
"id": "CVE-2018-1000094",
"lastModified": "2024-11-21T03:39:37.973",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-13T01:29:00.810",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11741"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44976/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11741"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44976/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-03-20 04:15
Modified
2024-11-21 04:55
Severity ?
Summary
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file).
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12275 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12275 | Exploit, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.13 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E4E89FAB-60D7-4AF3-B35F-EB52E7D8D135",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file)."
},
{
"lang": "es",
"value": "Filemanager en CMS Made Simple versi\u00f3n 2.2.13, permite una ejecuci\u00f3n de c\u00f3digo remota por medio de un archivo JPEG .php.jpegd, como es demostrado por el par\u00e1metro m1_files[] en el archivo admin/moduleinterface.php. El archivo debe ser enviado como application/octet-stream y contener c\u00f3digo PHP (no es necesario que sea un archivo JPEG v\u00e1lido)."
}
],
"id": "CVE-2020-10682",
"lastModified": "2024-11-21T04:55:50.440",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-03-20T04:15:16.053",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12275"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12275"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-26 17:29
Modified
2024-11-21 04:50
Severity ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ED903B2B-092D-46F4-9F95-6D010A45A891",
"versionEndIncluding": "2.2.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the \"install module\" feature."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en CMS Made Simple 2.2.8. En el m\u00f3dulo ModuleManager (en el archivo action.installmodule.php), es posible alcanzar una llamada no serializada con entradas no fiables y lograr una inyecci\u00f3n de objetos autenticada mediante la funcionalidad \"install module\"."
}
],
"id": "CVE-2019-9061",
"lastModified": "2024-11-21T04:50:54.633",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-26T17:29:01.793",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
},
{
"lang": "en",
"value": "CWE-1321"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-12 03:29
Modified
2024-11-21 04:12
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2A1B9E5B-97A3-467D-8B86-EFD31F2FD82C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) 2.2.6 tiene Cross-Site Scripting (XSS) persistente en admin/moduleinterface.php mediante el par\u00e1metro metadata."
}
],
"id": "CVE-2018-7893",
"lastModified": "2024-11-21T04:12:56.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-12T03:29:00.337",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-31 01:28
Modified
2024-11-21 00:26
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "69E7A821-AB2A-47C6-BADA-52FB6A41C8FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la caracter\u00edstica mailform en CMSimple 2.7 fix1 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante el par\u00e1metro sender. NOTA: la procedencia de esta informaci\u00f3n es desconocida; los detalles se han obtenido de informaci\u00f3n de terceros."
}
],
"id": "CVE-2007-0610",
"lastModified": "2024-11-21T00:26:18.247",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-31T01:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/32976"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23951"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22250"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31841"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/32976"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/23951"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22250"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31841"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-27 18:29
Modified
2024-11-21 03:41
Severity ?
Summary
CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7 contiene una vulnerabilidad de fuga de ruta f\u00edsica mediante /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php o /modules/FileManager/untgz.php."
}
],
"id": "CVE-2018-10523",
"lastModified": "2024-11-21T03:41:29.750",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-27T18:29:00.743",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-27 18:29
Modified
2024-11-21 03:41
Severity ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file view\" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7, la operaci\u00f3n \"file view\" en el dashboard de administrador contiene una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n sensible, explotable por los usuarios ordinarios, debido a que el producto expone un acceso no restringido a la funci\u00f3n file_get_contents de PHP."
}
],
"id": "CVE-2018-10522",
"lastModified": "2024-11-21T03:41:29.610",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-27T18:29:00.697",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-12-17 17:30
Modified
2024-11-21 00:54
Severity ?
Summary
Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.4.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en admin/login.php en CMS Made Simple v1.4.1 permitiria a atacantes remotos leer ficheros a su eleccion a traves de .. (doble punto) en la cookie cms_language."
}
],
"id": "CVE-2008-5642",
"lastModified": "2024-11-21T00:54:31.980",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-12-17T17:30:00.843",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32924"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/4775"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/32535"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/3306"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46942"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/7285"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32924"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/4775"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/32535"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/3306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46942"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/7285"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-04-25 03:29
Modified
2024-11-21 04:21
Severity ?
Summary
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12022 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12022 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "50758D7B-58C5-4A6C-876C-584BEAE12FF7",
"versionEndIncluding": "2.2.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the \"New name\" field in a Rename action."
},
{
"lang": "es",
"value": "El Administrador de Archivos en el CMS Made Simple, hasta la versi\u00f3n 2.2.10, es vulnerable a un XSS reflejado a trav\u00e9s del campo \"Nuevo nombre\" en una acci\u00f3n Renombrar."
}
],
"id": "CVE-2019-11513",
"lastModified": "2024-11-21T04:21:14.740",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-25T03:29:00.307",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12022"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12022"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-18 19:29
Modified
2024-11-21 03:39
Severity ?
Summary
cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/11762 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/11762 | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "29313D93-1839-4062-B70D-7052DC6DF0FC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line \"$url = $config[\u0027admin_url\u0027] . \u0027/login.php?recoverme=\u0027 . $code;\" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack."
},
{
"lang": "es",
"value": "cmsmadesimple 2.2.7 contiene una vulnerabilidad de control de acceso incorrecto en la funci\u00f3n send_recovery_email en la l\u00ednea \"$url = $config[\u0027admin_url\u0027] . \u0027/login.php?recoverme=\u0027 . $code;\" que puede resultar en el envenenamiento del restablecimiento de la contrase\u00f1a del administrador, espec\u00edficamente una URL de restablecimiento que se\u00f1ala a un servidor controlado por el atacante que se puede crear empleando un ataque de cabecera host."
}
],
"id": "CVE-2018-1000158",
"lastModified": "2024-11-21T03:39:48.950",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-18T19:29:00.223",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11762"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11762"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 18:15
Modified
2024-11-21 05:29
Severity ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Email address to receive notification of news submission\" parameter under the \"Options\" module."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versi\u00f3n 2.2.14, permite a atacantes autenticados ejecutar script web o HTML arbitrarios por medio de una carga \u00fatil dise\u00f1ada introducida en el par\u00e1metro \"Email address to receive notification of news submission\" en el m\u00f3dulo \"Options\""
}
],
"id": "CVE-2020-36410",
"lastModified": "2024-11-21T05:29:26.620",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T18:15:08.780",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-26 22:29
Modified
2024-11-21 04:18
Severity ?
Summary
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12003 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12003 | Exploit, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "53CC645D-1656-4215-B866-0644CD48B958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has XSS via the myaccount.php \"Email Address\" field, which is reachable via the \"My Preferences -\u003e My Account\" section."
},
{
"lang": "es",
"value": "CMS Made Simple 2.2.10 tiene Cross-Site Scripting (XSS) mediante el campo \"Email Address\" en myaccount.php, que es alcanzable mediante la secci\u00f3n \"My Preferences -\u003e My Account\"."
}
],
"id": "CVE-2019-10107",
"lastModified": "2024-11-21T04:18:25.330",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-26T22:29:00.630",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12003"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12003"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-12-19 19:29
Modified
2024-11-21 03:58
Severity ?
Summary
CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DC3D9A-3D6A-4B67-8B5E-A9920555EDE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798."
},
{
"lang": "es",
"value": "CMS Made Simple 2.2.8 permite Cross-Site Scripting (XSS) mediante un documento SVG manipulado. Este problema est\u00e1 relacionado con CVE-2017-16798."
}
],
"id": "CVE-2018-19597",
"lastModified": "2024-11-21T03:58:15.647",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-12-19T19:29:00.463",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-02-26 17:29
Modified
2024-11-21 04:12
Severity ?
Summary
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/project/changelog/5471 | Release Notes | |
| cve@mitre.org | https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.exploit-db.com/exploits/44192/ | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/project/changelog/5471 | Release Notes | |
| af854a3a-2127-422b-91ae-364da2661108 | https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/44192/ | Exploit, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.1.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBC308C-C925-443C-94D1-E0D3B6E6BBB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the \"timezone\" parameter in step 4 of a fresh installation procedure."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en /cmsms-2.1.6-install.php/index.php en CMS Made Simple 2.1.6 permite que atacantes remotos inyecten c\u00f3digo PHP arbitrario mediante el par\u00e1metro \"timezone\" en el paso 4 del procedimiento de nueva instalaci\u00f3n."
}
],
"id": "CVE-2018-7448",
"lastModified": "2024-11-21T04:12:09.360",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-02-26T17:29:00.287",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5471"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44192/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5471"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/44192/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-04-13 23:15
Modified
2024-11-21 06:28
Severity ?
Summary
Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.15 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "47371FA0-89B6-4625-B43D-AFC56252F4CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de tipo Cross Site Scripting (XSS) en CMS Made Simple versi\u00f3n 2.2.15, por medio del campo Name en una acci\u00f3n Add Category en el archivo moduleinterface.php"
}
],
"id": "CVE-2021-43154",
"lastModified": "2024-11-21T06:28:44.167",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-04-13T23:15:07.633",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Broken Link"
],
"url": "https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Broken Link"
],
"url": "https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-13 05:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A810FE45-F6E3-47D7-A3C9-DF05CF81DAFD",
"versionEndIncluding": "2.2.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \\lib\\classes\\internal\\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.6 permite la inyecci\u00f3n de objetos PHP debido a una llamada unserialize en la funci\u00f3n _get_data de \\lib\\classes\\internal\\class.LoginOperations.php. Mediante el env\u00edo de una cookie manipulada, un atacante remoto puede subir y ejecutar c\u00f3digo o eliminar archivos"
}
],
"id": "CVE-2018-10085",
"lastModified": "2024-11-21T03:40:47.587",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-13T05:29:00.430",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-05-12 16:05
Modified
2024-11-21 01:14
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "77E35FF6-DE6D-451D-B6D6-F42A01174712",
"versionEndIncluding": "1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4D76634F-6DC4-49CD-8060-21F2ED17F652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C0FBFCAD-8850-4804-9B2A-566FDDE39685",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C94DE9A2-E9AA-43BC-8D1F-EFA97722C482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:beta5:*:*:*:*:*:*",
"matchCriteriaId": "0B2004E5-1AC3-4EDF-B160-F258769040D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C097A9F3-96A3-4893-944E-8AF89D37CED1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0DCBA3A6-3776-470D-BFC7-E4836D2A586F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7F327F-CA20-47C1-BF99-AB4A439EAB07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "04796760-3ED2-4B65-B571-6685916A8130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B7A5E24-6619-45E5-8020-3176B53E39C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:beta2:*:*:*:*:*:*",
"matchCriteriaId": "23EC4CE4-70A6-4CF8-8725-B7B811702854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B5C6034-A597-41A6-9F1A-F3DAB63DF31C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9FE3B4A8-9C8A-46D2-A8EB-49FD3533ED3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta1:*:*:*:*:*:*",
"matchCriteriaId": "146A6076-43F1-44C5-B111-29715C7A21C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta2:*:*:*:*:*:*",
"matchCriteriaId": "4FCCAF43-71C3-4AC5-A094-9F6F2DE281D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta3:*:*:*:*:*:*",
"matchCriteriaId": "71FD39E0-75EE-4735-97B5-2AE12C16B63B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "5CF35F3A-634C-4C36-B3E6-F1208F9D01F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "0349FD9D-06E4-4B17-8360-003111D16A22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "E2D0D697-D088-40B1-8D80-B881A7530006",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "7F29A39F-4D8A-4683-8561-8C77B17005F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "E6C93E33-ABC4-434F-AF93-F8F697D5D62A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "36B57E13-2F90-49DD-988F-8A7F776536ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A5AAB099-B114-4A99-B086-9BA7866D4E7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "942BF218-1898-4135-9CA9-FAE4F091C883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "ACB091A6-5B3A-4C2B-9CD8-3C59549772EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "ABDA3920-B609-491E-858B-5D9CBC7F1955",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "8089FEC3-3E01-4D8E-BACB-6A42781D5151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "49DE10A7-9BC6-4B33-97FC-5FEB44AEAFBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6A607317-26A0-431B-AC83-2637CD2C5561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CD8C48F5-844F-425D-A577-C0D6D3037F76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta3:*:*:*:*:*:*",
"matchCriteriaId": "29389D5B-96DA-4889-AE13-848CD959414C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "7A575B72-7763-4BA4-A1BF-96B31203479A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98D93656-A4D2-44C4-82EC-55C8BE1A7304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BAEAE47F-5A26-474E-8F7F-72976A8FEBA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E188A80A-980F-4AD8-B3B8-21D303121F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E730A3A8-8A60-4CC5-B167-26984DE0DA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA19F5B2-7C5C-43DD-85ED-E2CD4EF6E748",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "778E5678-B763-415E-AA35-EF644E7A2CD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7DEC1EBC-1DBA-4350-8B34-7A872C62B6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "078B102C-748B-4847-8413-71659982AF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "91C39415-8F99-45FB-BE00-1888901BB4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F8649F4-1A33-41AE-888F-2D6BB19BCB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F6D11F61-8D0C-4545-9193-370D6D01ECB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta2:*:*:*:*:*:*",
"matchCriteriaId": "60F2A706-CBF1-42F5-AC04-E68C1981CCB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "206B72EC-895E-4DA0-B41B-AAE41E53C108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:beta1:*:*:*:*:*:*",
"matchCriteriaId": "A46A8B81-2D8D-431A-832A-4517E9616B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC131029-CE9C-437E-B3D3-7924062E14D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF34A817-09AC-4C7E-916B-1B158C5EE599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20E8FFE1-9431-4146-AFD3-5491F5FE3C23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1016173-D980-4909-86C0-81C94711FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "068BF668-9626-4CA4-A401-1946DCF916AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA029BD9-1025-4802-BAE2-BEE218715FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9928102A-27E2-4604-93F4-318BA7CDCAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1EECFB4-7001-411F-BBAE-BABD5248E4B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40C6F2FA-0518-4B2A-9F05-51897A16AF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A35145EB-E7A7-48EC-91A9-9D423F316712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "589C199E-12F9-41CF-BFE0-4B952B773460",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7BB9992D-2EF4-4DBF-898A-6284A074403E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en admin/editprefs.php en el backend de CMS Made Simple (CMSMS) antes de v1.7.1 podr\u00eda permitir a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro date_format_string."
}
],
"id": "CVE-2010-1482",
"lastModified": "2024-11-21T01:14:31.400",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-05-12T16:05:02.733",
"references": [
{
"source": "cve@mitre.org",
"url": "http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/archive/1/511178"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/39997"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/archive/1/511178"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/39997"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-12-17 23:15
Modified
2024-11-21 05:11
Severity ?
Summary
Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E58183CB-D62D-48EC-9808-3D9C768EC69E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross Site Scripting (XSS) en el m\u00f3dulo Showtime2 Slideshow en CMS Made Simple (CMSMS) versi\u00f3n 2.2.4"
}
],
"id": "CVE-2020-20138",
"lastModified": "2024-11-21T05:11:52.850",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-12-17T23:15:13.357",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/160604/Flexmonster-Pivot-Table-And-Charts-2.7.17-Cross-Site-Scripting.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-27 18:29
Modified
2024-11-21 03:41
Severity ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file rename\" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7, la operaci\u00f3n \"file rename\" en el dashboard de administrador contiene una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n sensible, explotable por un usuario administrador, que puede provocar una denegaci\u00f3n de servicio (DoS) moviendo config.php al directorio upload/."
}
],
"id": "CVE-2018-10516",
"lastModified": "2024-11-21T03:41:28.760",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-27T18:29:00.367",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-13 05:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the \"0e\" substring."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.6 contiene una vulnerabilidad de restablecimiento de contrase\u00f1a de administrador debido a que los valores de datos se comparan de forma incorrecta. Esto se demuestra con un hash que empieza con la subcadena \"0e\"."
}
],
"id": "CVE-2018-10081",
"lastModified": "2024-11-21T03:40:47.017",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-13T05:29:00.213",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-640"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-11 19:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799."
},
{
"lang": "es",
"value": "CMS Made Simple (tambi\u00e9n conocido como CMSMS) 2.2.7 tiene Cross-Site Scripting (XSS) reflejado en admin/moduleinterface.php a trav\u00e9s del par\u00e1metro m1_name. Esto est\u00e1 relacionado con con moduledepends y es una vulnerabilidad diferente de CVE-2017-16799."
}
],
"id": "CVE-2018-10029",
"lastModified": "2024-11-21T03:40:42.417",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-11T19:29:00.760",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-19 22:15
Modified
2024-11-21 08:24
Severity ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager | Exploit, Product, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager | Exploit, Product, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component."
},
{
"lang": "es",
"value": "La vulnerabilidad de Cross-Site Scripting (XSS) en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado para los par\u00e1metros de datos Smarty y metadatos espec\u00edficos de la p\u00e1gina en el componente del Men\u00fa del Administrador de Contenido."
}
],
"id": "CVE-2023-43359",
"lastModified": "2024-11-21T08:24:03.317",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-19T22:15:09.720",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Product",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Product",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-27 18:29
Modified
2024-11-21 03:41
Severity ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file move\" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7, la operaci\u00f3n \"file move\" en el dashboard de administrador contiene una vulnerabilidad de movimiento de archivos arbitrarios que puede provocar una denegaci\u00f3n de servicio (DoS), explotable por un usuario administrador, debido a que config.php puede moverse a un directorio incorrecto."
}
],
"id": "CVE-2018-10521",
"lastModified": "2024-11-21T03:41:29.473",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-27T18:29:00.633",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-03-09 09:59
Modified
2024-11-21 03:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage > sitesetting > General Settings > globalmetadata" field.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.daimacn.com/?id=8 | Exploit, Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/96933 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.daimacn.com/?id=8 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/96933 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.1.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBC308C-C925-443C-94D1-E0D3B6E6BBB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the \"adminpage \u003e sitesetting \u003e General Settings \u003e globalmetadata\" field."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en CMS Made Simple (CMSMS) 2.1.6 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del campo \"adminpage \u003e sitesetting \u003e General Settings \u003e globalmetadata\"."
}
],
"id": "CVE-2017-6556",
"lastModified": "2024-11-21T03:30:01.407",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-03-09T09:59:00.347",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://www.daimacn.com/?id=8"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/96933"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://www.daimacn.com/?id=8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/96933"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-10-11 22:55
Modified
2024-11-21 01:55
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * | |
| cmsmadesimple | cms_made_simple | 1.11 | |
| cmsmadesimple | cms_made_simple | 1.11.1 | |
| cmsmadesimple | cms_made_simple | 1.11.2 | |
| cmsmadesimple | cms_made_simple | 1.11.2.1 | |
| cmsmadesimple | cms_made_simple | 1.11.3 | |
| cmsmadesimple | cms_made_simple | 1.11.4 | |
| cmsmadesimple | cms_made_simple | 1.11.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC15CE10-4ABB-4277-8CAC-D714A02BA4E9",
"versionEndIncluding": "1.11.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "578303F3-6729-45A9-8DBE-A2C393E7BB2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "93A32CE1-85A4-417F-90D4-1378B61A45E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D63AC3D8-0297-423B-9D50-59F7B1582348",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "272A22FB-4553-47FD-88D6-B2D0C096F6EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C57412ED-477E-463D-91AB-CC02149A6E23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B2AB67E7-4528-4AE0-9B60-DD5B1B71D17E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5CD8DAF5-2EE2-40D2-9DFA-1D2BA749757D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en CMS Made Simple (CMSMS) anterior a la versi\u00f3n 1.11.7 permite a atacantes remotos inyectar script web o HTML arbitrario a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2013-4167",
"lastModified": "2024-11-21T01:55:00.567",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-10-11T22:55:39.660",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=66590\u0026p=299356"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/07/21/1"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/07/25/7"
},
{
"source": "secalert@redhat.com",
"url": "https://twitter.com/LeakFree/status/336942367351394305"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=66590\u0026p=299356"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/07/21/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/07/25/7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://twitter.com/LeakFree/status/336942367351394305"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-03-24 15:59
Modified
2024-11-21 03:31
Severity ?
Summary
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.03i0.com/index.php/archives/113/ | Exploit, Third Party Advisory, URL Repurposed | |
| cve@mitre.org | http://www.securityfocus.com/bid/97204 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.03i0.com/index.php/archives/113/ | Exploit, Third Party Advisory, URL Repurposed | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/97204 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.1.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBC308C-C925-443C-94D1-E0D3B6E6BBB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XSS exists in the CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" feature via the m1_summary parameter. Someone must login to conduct the attack."
},
{
"lang": "es",
"value": "XSS existe en la caracter\u00edstica CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" caracter\u00edstica a trav\u00e9s del par\u00e1metro m1_summary. Alguien debe iniciar sesi\u00f3n para realizar el ataque."
}
],
"id": "CVE-2017-7256",
"lastModified": "2024-11-21T03:31:29.250",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-03-24T15:59:01.357",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"URL Repurposed"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/97204"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"URL Repurposed"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/97204"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-27 18:29
Modified
2024-11-21 03:41
Severity ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file delete\" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7, la operaci\u00f3n \"module import\" en el dashboard de administrador contiene una vulnerabilidad de eliminaci\u00f3n de archivos arbitrarios que puede provocar una denegaci\u00f3n de servicio (DoS), explotable por un usuario administrador, debido a que el atacante puede eliminar todos los archivos lib/ en todos los directorios."
}
],
"id": "CVE-2018-10518",
"lastModified": "2024-11-21T03:41:29.060",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "NONE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 9.2,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-27T18:29:00.477",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-20 22:15
Modified
2024-11-21 08:24
Severity ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component."
},
{
"lang": "es",
"value": "Vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado en el par\u00e1metro Profiles en el componente del editor Extensions -MicroTiny WYSIWYG."
}
],
"id": "CVE-2023-43354",
"lastModified": "2024-11-21T08:24:02.550",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-20T22:15:10.683",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2016-05-26 14:59
Modified
2024-11-21 02:48
Severity ?
Summary
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A5AAB099-B114-4A99-B086-9BA7866D4E7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "942BF218-1898-4135-9CA9-FAE4F091C883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "49DE10A7-9BC6-4B33-97FC-5FEB44AEAFBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98D93656-A4D2-44C4-82EC-55C8BE1A7304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BAEAE47F-5A26-474E-8F7F-72976A8FEBA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E188A80A-980F-4AD8-B3B8-21D303121F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E730A3A8-8A60-4CC5-B167-26984DE0DA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA19F5B2-7C5C-43DD-85ED-E2CD4EF6E748",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "778E5678-B763-415E-AA35-EF644E7A2CD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "91C39415-8F99-45FB-BE00-1888901BB4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F8649F4-1A33-41AE-888F-2D6BB19BCB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "206B72EC-895E-4DA0-B41B-AAE41E53C108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC131029-CE9C-437E-B3D3-7924062E14D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF34A817-09AC-4C7E-916B-1B158C5EE599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20E8FFE1-9431-4146-AFD3-5491F5FE3C23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1016173-D980-4909-86C0-81C94711FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "068BF668-9626-4CA4-A401-1946DCF916AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA029BD9-1025-4802-BAE2-BEE218715FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9928102A-27E2-4604-93F4-318BA7CDCAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1EECFB4-7001-411F-BBAE-BABD5248E4B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40C6F2FA-0518-4B2A-9F05-51897A16AF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A35145EB-E7A7-48EC-91A9-9D423F316712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "589C199E-12F9-41CF-BFE0-4B952B773460",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7BB9992D-2EF4-4DBF-898A-6284A074403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B18A2D88-5B3E-4CCF-B979-F7D7A9F7EA1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "36B86387-A26E-4017-B3FA-45E1BF90D9B4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "9295BA82-379C-43FE-B2D1-B7929E108F0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2F14D3BD-5835-4206-BE44-72F31F46D067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "61F2E017-EEBD-473F-A15A-FD7B52A74E5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EE7E3436-2FF9-4DC6-A552-A46330220AF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C5A4D84-4C6D-453D-B1D3-2445DD7213C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC3F038-4441-4409-9384-26565F6385EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "CF32C8E8-0937-453E-9487-395331A50611",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9523997A-4302-411D-8BF2-711A28969704",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "95ED7D98-40D4-41C3-8029-EDC5A41EEBAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F744F6-DCAE-486A-BED8-F560186628C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A152CC40-72E0-4200-8670-CD99C69141EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F9B346F2-919D-4D5E-AFFF-25531AC3676E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F7C0B4EB-BA28-4BBE-8A73-926DC0B38F54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2DA09626-9C30-4FAB-82A6-A7D5903127BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "4263AF5A-FE04-4EAC-87C2-03B042C0A71E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "ECB069E1-970B-456E-B477-DCD68F4CCCBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D205015-13AE-45D2-9309-3D9C90B0C3D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "18C19AF4-A88F-4835-8A36-394637C6BD64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "578303F3-6729-45A9-8DBE-A2C393E7BB2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "93A32CE1-85A4-417F-90D4-1378B61A45E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D63AC3D8-0297-423B-9D50-59F7B1582348",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "272A22FB-4553-47FD-88D6-B2D0C096F6EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C57412ED-477E-463D-91AB-CC02149A6E23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B2AB67E7-4528-4AE0-9B60-DD5B1B71D17E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5CD8DAF5-2EE2-40D2-9DFA-1D2BA749757D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "F883A9BD-A10A-4EA5-AE2C-22994D650E0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "B35E25E4-A524-43FF-923F-446DB297CE26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2E8C4A8F-1A37-4A7B-A702-E889FF17FAF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4A1B4A9B-EE73-4BDC-A4DA-966EAF49CC5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.10:*:*:*:*:*:*:*",
"matchCriteriaId": "11DBE7DB-344E-4085-ABA4-E8058948B69B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.11:*:*:*:*:*:*:*",
"matchCriteriaId": "9F683B79-8979-416C-9879-1B243F8499D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.12:*:*:*:*:*:*:*",
"matchCriteriaId": "F5FF3EF4-A8A8-48AE-BA5E-ACEBCD66730C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3C3CB267-CB92-43A8-8F54-5E5E6BACD06C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "908EF5A9-559B-4867-84EB-4E7879F35FB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B2C65586-DB2A-4546-8066-1E768277CA08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "389CB2B3-4933-4F8D-90F4-E5EE9CDA4201",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "35C6F173-C048-423A-9D02-32C76B984863",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.0.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87EAFA66-0CC0-46C4-A661-54F59D2E31AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6DBC33E0-708B-497A-B3F7-33A525144256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "488531A2-5E42-4A89-BB62-1EBFD3F5BC4F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "ADDCAA0F-E9B6-4050-A211-D1CF9991F525",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request."
},
{
"lang": "es",
"value": "CMS Made Simple 2.x en versiones anteriores a 2.1.3 y 1.x en versiones anteriores a 1.12.2, cuando est\u00e1 activada la Smarty Cache, permiten a atacantes remotos llevar a cabo ataques de envenenamiento de la cach\u00e9, modificar enlaces y llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) a trav\u00e9s de una cabecera HTTP Host manipulada en una petici\u00f3n."
}
],
"id": "CVE-2016-2784",
"lastModified": "2024-11-21T02:48:48.010",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.6,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-05-26T14:59:00.133",
"references": [
{
"source": "cve@mitre.org",
"url": "http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/fulldisclosure/2016/May/15"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/"
},
{
"source": "cve@mitre.org",
"url": "http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/538272/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/39760/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/fulldisclosure/2016/May/15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/538272/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/39760/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 18:15
Modified
2024-11-21 05:29
Severity ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "URL (slug)" or "Extra" fields under the "Add Article" feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"URL (slug)\" or \"Extra\" fields under the \"Add Article\" feature."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versi\u00f3n 2.2.14, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de una carga \u00fatil dise\u00f1ada introducida en los campos \"URL (slug)\" o \"Extra\" en la funcionalidad \"Add Article\""
}
],
"id": "CVE-2020-36414",
"lastModified": "2024-11-21T05:29:27.297",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T18:15:08.940",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-26 22:15
Modified
2024-11-21 08:24
Severity ?
Summary
An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CMSmadesimple-SSTI--Content | Exploit, Third Party Advisory | |
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CMSmadesimple-SSTI--Content | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component."
},
{
"lang": "es",
"value": "Un problema en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un payload manipulado en el componente Content Manager Menu."
}
],
"id": "CVE-2023-43352",
"lastModified": "2024-11-21T08:24:02.243",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-26T22:15:08.700",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-SSTI--Content"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-SSTI--Content"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43352-CMSmadesimple-SSTI--Content"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-06-19 17:15
Modified
2024-11-21 05:04
Severity ?
Summary
CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12324 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12324 | Exploit, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page."
},
{
"lang": "es",
"value": "CMS Made Simple versi\u00f3n 2.2.14, permite un ataque de tipo XSS por medio de Search Term en la p\u00e1gina admin/moduleinterface.php?mact=ModuleManager"
}
],
"id": "CVE-2020-14926",
"lastModified": "2024-11-21T05:04:26.933",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-19T17:15:18.240",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12324"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12324"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-25 18:17
Modified
2024-11-21 08:24
Severity ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CMSmadesimple-Stored-XSS---File-Picker-extension | Exploit, Third Party Advisory | |
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CMSmadesimple-Stored-XSS---File-Picker-extension | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross-Site Scripting (XSS) en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado en el par\u00e1metro Top Directory en el componente File Picker Menu."
}
],
"id": "CVE-2023-43360",
"lastModified": "2024-11-21T08:24:03.497",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-25T18:17:31.757",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-Stored-XSS---File-Picker-extension"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-Stored-XSS---File-Picker-extension"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-26 21:15
Modified
2024-11-21 05:13
Severity ?
Summary
Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12322 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12322 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in \"Extra\" via \u0027News \u003e Article\" feature."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross Site Scripting (XSS) en CMS Made Simple versi\u00f3n 2.2.14, en \"Extra\" por medio de la funcionalidad \"News ) Article\""
}
],
"id": "CVE-2020-23241",
"lastModified": "2024-11-21T05:13:40.107",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-26T21:15:16.620",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12322"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12322"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-02-21 07:59
Modified
2024-11-21 03:29
Severity ?
Summary
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/project/files/69 | Product | |
| cve@mitre.org | https://daylight-it.com/security-advisory-dlcs0001.html | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/project/files/69 | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | https://daylight-it.com/security-advisory-dlcs0001.html | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | form_builder | * | |
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:form_builder:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D4E11B70-26B8-4C0C-A545-5CBC12AC2FFA",
"versionEndIncluding": "0.8.1.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DBC86285-74C1-45C4-B9E6-C74B992D3DC2",
"versionEndIncluding": "1.12.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin."
},
{
"lang": "es",
"value": "CMS Made Simple versi\u00f3n 1.x Form Builder antes de la versi\u00f3n 0.8.1.6 permite a atacantes remotos llevar a cabo ataques de divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s de defaultadmin."
}
],
"id": "CVE-2017-6072",
"lastModified": "2024-11-21T03:29:02.330",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-02-21T07:59:00.453",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-13 15:29
Modified
2024-11-21 03:39
Severity ?
Summary
CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/11715 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/11715 | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB7ED7E9-D2F9-416D-B33C-C6113C1E331E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6."
},
{
"lang": "es",
"value": "CMS Made Simple, versi\u00f3n 2.2.5, contiene una vulnerabilidad de Cross-Site Request Forgery (CSRF) en la p\u00e1gina de perfil de Administrador, cuyos detalles pueden encontrarse aqu\u00ed http://dev.cmsmadesimple.org/bug/view/11715. Este ataque parece ser explotable mediante una p\u00e1gina web especialmente manipulada. La vulnerabilidad parece haber sido solucionada en la versi\u00f3n 2.2.6."
}
],
"id": "CVE-2018-1000092",
"lastModified": "2024-11-21T03:39:37.670",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-13T15:29:01.533",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11715"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/11715"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-26 17:29
Modified
2024-11-21 04:50
Severity ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ED903B2B-092D-46F4-9F95-6D010A45A891",
"versionEndIncluding": "2.2.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en CMS Made Simple 2.2.8. En el m\u00f3dulo FilePicker, es posible alcanzar una llamada no serializada con un par\u00e1metro no fiable y lograr inyectar objetos autenticados."
}
],
"id": "CVE-2019-9057",
"lastModified": "2024-11-21T04:50:54.063",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-26T17:29:01.527",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
},
{
"lang": "en",
"value": "CWE-915"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-09-25 16:15
Modified
2024-11-21 08:24
Severity ?
Summary
Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name, DataBase User or Database Port components.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.cmsmadesimple.org/ | Product | |
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation/blob/main/README.md | Exploit, Third Party Advisory | |
| cve@mitre.org | https://github.com/sromanhu/Cmsmadesimple-CMS-Stored-XSS/blob/main/README.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.cmsmadesimple.org/ | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation/blob/main/README.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/Cmsmadesimple-CMS-Stored-XSS/blob/main/README.md | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name, DataBase User or Database Port components."
},
{
"lang": "es",
"value": "La vulnerabilidad de Cross-Site Scripting (XSS) en cmsmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un payload manipulado inyectado en los componentes Nombre de la base de datos, Usuario de la base de datos o Puerto de la base de datos."
}
],
"id": "CVE-2023-43339",
"lastModified": "2024-11-21T08:24:00.780",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-09-25T16:15:14.640",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://www.cmsmadesimple.org/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation/blob/main/README.md"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/Cmsmadesimple-CMS-Stored-XSS/blob/main/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://www.cmsmadesimple.org/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation/blob/main/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/Cmsmadesimple-CMS-Stored-XSS/blob/main/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-11-10 23:29
Modified
2024-11-21 03:16
Severity ?
Summary
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/159690/CMS-Made-Simple-2.1.6-Server-Side-Template-Injection.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://www.netsparker.com/web-applications-advisories/ns-17-032-server-side-template-injection-vulnerability-in-cms-made-simple/ | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/159690/CMS-Made-Simple-2.1.6-Server-Side-Template-Injection.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.netsparker.com/web-applications-advisories/ns-17-032-server-side-template-injection-vulnerability-in-cms-made-simple/ | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.1.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBC308C-C925-443C-94D1-E0D3B6E6BBB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter."
},
{
"lang": "es",
"value": "En CMS Made Simple 2.1.6, existe inyecci\u00f3n de plantillas del lado del servidor mediante el par\u00e1metro cntnt01detailtemplate."
}
],
"id": "CVE-2017-16783",
"lastModified": "2024-11-21T03:16:57.870",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-11-10T23:29:00.353",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/159690/CMS-Made-Simple-2.1.6-Server-Side-Template-Injection.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-032-server-side-template-injection-vulnerability-in-cms-made-simple/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/159690/CMS-Made-Simple-2.1.6-Server-Side-Template-Injection.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-032-server-side-template-injection-vulnerability-in-cms-made-simple/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-27 18:29
Modified
2024-11-21 03:41
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "29313D93-1839-4062-B70D-7052DC6DF0FC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this-\u003e_loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) 2.2.7 contiene una vulnerabilidad de escalado de privilegios de usuario ordinario a usuario administrador haciendo que el valor de eff_uid en $_COOKIE[$this-\u003e_loginkey] sea igual a 1. Esto se debe a que se puede acceder a los archivos en el directorio tmp/ mediante peticiones HTTP. NOTA: Esta vulnerabilidad existe debido a una soluci\u00f3n incorrecta para CVE-2018-10084."
}
],
"id": "CVE-2018-10519",
"lastModified": "2024-11-21T03:41:29.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-27T18:29:00.523",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-18 00:29
Modified
2024-11-21 03:07
Severity ?
Summary
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "374F6E2F-C2A4-46D4-9932-FCE2FFFFAB07",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS) versi\u00f3n 2.2.2, los administradores autenticados remotos pueden cargar un archivo .php por medio de una acci\u00f3n CMSContentManager en el archivo admin/moduleinterface.php, seguido por una acci\u00f3n FilePicker en el archivo admin/moduleinterface.php en la que type=image es cambiada a type=file."
}
],
"id": "CVE-2017-11405",
"lastModified": "2024-11-21T03:07:43.327",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-18T00:29:00.277",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/filepickerimages/FilePicker_upload_vulnerability.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/filepickerimages/FilePicker_upload_vulnerability.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 18:15
Modified
2024-11-21 05:29
Severity ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Add Shortcut\" parameter under the \"Manage Shortcuts\" module."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versi\u00f3n 2.2.14, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de una carga \u00fatil dise\u00f1ada introducida en el par\u00e1metro \"Add Shortcut\" del m\u00f3dulo \"Manage Shortcuts\""
}
],
"id": "CVE-2020-36408",
"lastModified": "2024-11-21T05:29:26.313",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T18:15:08.703",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-10-16 14:15
Modified
2024-11-21 04:32
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12146 | Exploit, Vendor Advisory | |
| cve@mitre.org | https://forum.cmsmadesimple.org/viewforum.php?f=1 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12146 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://forum.cmsmadesimple.org/viewforum.php?f=1 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.11 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D2FF3435-82A1-498B-88AE-B00DE6C31009",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the \"file manager \u003e upload images\" screen."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) versi\u00f3n 2.2.11, permite un ataque de tipo XSS almacenado por parte de un administrador mediante un nombre de archivo de imagen dise\u00f1ado en la pantalla \"file manager ) upload images\"."
}
],
"id": "CVE-2019-17629",
"lastModified": "2024-11-21T04:32:39.720",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-10-16T14:15:14.150",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12146"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12146"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-10-12 19:29
Modified
2024-11-21 03:55
Severity ?
Summary
XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13 | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "29313D93-1839-4062-B70D-7052DC6DF0FC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php \"Content--\u003eNews--\u003eAdd Article\" action."
},
{
"lang": "es",
"value": "Existe Cross-Site Scripting (XSS) en CMS Made Simple 2.2.7 mediante el par\u00e1metro m1_extra en una acci\u00f3n \"Content--\u003eNews--\u003eAdd Article\" en admin/moduleinterface.php."
}
],
"id": "CVE-2018-18271",
"lastModified": "2024-11-21T03:55:37.893",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-10-12T19:29:00.407",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-11-10 23:29
Modified
2024-11-21 03:16
Severity ?
Summary
In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "374F6E2F-C2A4-46D4-9932-FCE2FFFFAB07",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter."
},
{
"lang": "es",
"value": "En CMS Made Simple 2.2.2, existe Cross-Site Scripting (XSS) reflejado mediante el par\u00e1metro cntnt01detailtemplate."
}
],
"id": "CVE-2017-16784",
"lastModified": "2024-11-21T03:16:58.010",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-11-10T23:29:00.400",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-031-reflected-xss-vulnerability-in-cms-made-simple/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.netsparker.com/web-applications-advisories/ns-17-031-reflected-xss-vulnerability-in-cms-made-simple/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-02-28 23:15
Modified
2024-11-21 06:49
Severity ?
Summary
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12502 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12502 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.15 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "47371FA0-89B6-4625-B43D-AFC56252F4CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file."
},
{
"lang": "es",
"value": "Se ha detectado que CMS Made Simple versi\u00f3n v2.2.15, contiene una vulnerabilidad de Ejecuci\u00f3n de Comandos Remota (RCE) por medio de la funci\u00f3n upload avatar. Esta vulnerabilidad es explotada por medio de un archivo de imagen dise\u00f1ado."
}
],
"id": "CVE-2022-23906",
"lastModified": "2024-11-21T06:49:26.473",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-02-28T23:15:12.477",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12502"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12502"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 18:15
Modified
2024-11-21 05:29
Severity ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Exclude these IP addresses from the "Site Down" status" parameter under the "Maintenance Mode" module.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Exclude these IP addresses from the \"Site Down\" status\" parameter under the \"Maintenance Mode\" module."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versi\u00f3n 2.2.14, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de una carga \u00fatil dise\u00f1ada introducida en el par\u00e1metro \"Exclude these IP addresses from the \"Site Down\" status\" en el m\u00f3dulo \"Maintenance Mode\""
}
],
"id": "CVE-2020-36413",
"lastModified": "2024-11-21T05:29:27.127",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T18:15:08.903",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-09-27 20:03
Modified
2024-11-21 00:01
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 0.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 0.10 allows remote attackers to inject arbitrary web script or HTML via the page parameter."
}
],
"id": "CVE-2005-3083",
"lastModified": "2024-11-21T00:01:05.403",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-09-27T20:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=112785315518373\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/14937"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=112785315518373\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/14937"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-09-24 22:17
Modified
2024-11-21 00:37
Severity ?
Summary
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| adodb_lite | adodb_lite | * | |
| cmsmadesimple | cms_made_simple | * | |
| journalness | journalness | * | |
| open-realty | open-realty | * | |
| pacercms | pacercms | * | |
| sapid | sapid_cmf | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adodb_lite:adodb_lite:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8F7145D0-2043-42D2-B2C5-56271595534F",
"versionEndIncluding": "1.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B439441E-3421-44BA-BBD0-4D23C582AD00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:journalness:journalness:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73F8DC33-618D-480D-A42B-3E86E612A862",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:open-realty:open-realty:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0C9B4A04-AFD2-4841-A4CB-CF89C4332884",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:pacercms:pacercms:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A4001203-43C4-4EC4-8CEA-B716847B85DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:sapid:sapid_cmf:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2658BB12-6F19-460B-9BD8-93ECC775E506",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de inyecci\u00f3n Eval en el archivo adodb-perf-module.inc.php en ADOdb Lite versiones 1.42 y anteriores, como es usado en productos como CMS Made Simple, SAPID CMF, Journalness, PacerCMS y Open-Realty, permite a atacantes remotos ejecutar c\u00f3digo arbitrario por medio de secuencias PHP en el par\u00e1metro last_module."
}
],
"id": "CVE-2007-5056",
"lastModified": "2024-11-21T00:37:02.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-09-24T22:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/40596"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/41422"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/41426"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/41427"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/41428"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26928"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28859"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28873"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28874"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28886"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.attrition.org/pipermail/vim/2007-September/001800.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/25768"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/3261"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36733"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40389"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40393"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40395"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40396"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/4442"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/5090"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/5091"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/5097"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/5098"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/40596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/41422"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/41426"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/41427"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/41428"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26928"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28859"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28873"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28874"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/28886"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.attrition.org/pipermail/vim/2007-September/001800.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/25768"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/3261"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36733"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40389"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40393"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40395"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/40396"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/4442"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/5090"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/5091"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/5097"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/5098"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-09-22 20:15
Modified
2024-11-21 05:13
Severity ?
Summary
CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12317 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12317 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field."
},
{
"lang": "es",
"value": "Se ha detectado que CMS Made Simple versi\u00f3n 2.2.14, contiene una vulnerabilidad de tipo cross-site scripting (XSS) que permite a atacantes ejecutar scripts web o HTML arbitrarios por medio de una carga \u00fatil dise\u00f1ada en el campo Field Definition text"
}
],
"id": "CVE-2020-23481",
"lastModified": "2024-11-21T05:13:49.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-09-22T20:15:08.230",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 18:15
Modified
2024-11-21 05:29
Severity ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Create a new Design\" parameter under the \"Designs\" module."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versi\u00f3n 2.2.14, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de una carga \u00fatil dise\u00f1ada introducida en el par\u00e1metro \"Create a new Design\" en el m\u00f3dulo \"Designs\""
}
],
"id": "CVE-2020-36416",
"lastModified": "2024-11-21T05:29:27.633",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T18:15:09.020",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 18:15
Modified
2024-11-21 05:29
Severity ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Stylesheet" parameter under the "Stylesheets" module.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Create a new Stylesheet\" parameter under the \"Stylesheets\" module."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versi\u00f3n 2.2.14, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de una carga \u00fatil dise\u00f1ada introducida en el par\u00e1metro \"Create a new Stylesheet\" en el m\u00f3dulo \"Stylesheets\""
}
],
"id": "CVE-2020-36415",
"lastModified": "2024-11-21T05:29:27.477",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T18:15:08.980",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-09-17 16:15
Modified
2024-11-21 04:50
Severity ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DC3D9A-3D6A-4B67-8B5E-A9920555EDE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1)."
},
{
"lang": "es",
"value": "Se ha detectado un problema en CMS Made Simple versi\u00f3n 2.2.8. Es posible lograr un salto de ruta no autenticado en el m\u00f3dulo CGExtensions (en el archivo action.setdefaulttemplate.php) con el par\u00e1metro m1_filename; y mediante el archivo action.showmessage.php, es posible leer el contenido de un archivo arbitrario (al usar ese salto de ruta con m1_prefname establecido en cg_errormsg y m1_resettodefault=1)"
}
],
"id": "CVE-2019-9060",
"lastModified": "2024-11-21T04:50:54.480",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-09-17T16:15:07.447",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5819"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5819"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-27 18:29
Modified
2024-11-21 03:41
Severity ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory | |
| cve@mitre.org | https://www.exploit-db.com/exploits/45793/ | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/45793/ | Exploit, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"module import\" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7, la operaci\u00f3n \"module import\" en el dashboard de administrador contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo explotable por un usuario administrador debido a que un paquete XML puede contener c\u00f3digo PHP cifrado en base64 en un elemento de datos."
}
],
"id": "CVE-2018-10517",
"lastModified": "2024-11-21T03:41:28.903",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-27T18:29:00.430",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/45793/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/45793/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 18:15
Modified
2024-11-21 05:29
Severity ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Category" parameter under the "Categories" module.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Add Category\" parameter under the \"Categories\" module."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versi\u00f3n 2.2.14, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de una carga \u00fatil dise\u00f1ada introducida en el par\u00e1metro \"Add Category\" del m\u00f3dulo \"Categories\""
}
],
"id": "CVE-2020-36409",
"lastModified": "2024-11-21T05:29:26.470",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T18:15:08.740",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-11 19:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php."
},
{
"lang": "es",
"value": "CMS Made Simple (tambi\u00e9n conocido como CMSMS) 2.2.7 tiene Cross-Site Request Forgery (CSRF) en admin/moduleinterface.php."
}
],
"id": "CVE-2018-10031",
"lastModified": "2024-11-21T03:40:42.730",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-11T19:29:00.870",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-11-26 23:15
Modified
2024-11-21 01:32
Severity ?
Summary
The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D257BE24-0FDE-411C-8D6E-73A338D93E33",
"versionEndExcluding": "1.9.4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles."
},
{
"lang": "es",
"value": "El m\u00f3dulo de noticias en CMSMS versiones anteriores a la versi\u00f3n 1.9.4.3, permite a atacantes remotos corromper nuevos art\u00edculos."
}
],
"id": "CVE-2011-4310",
"lastModified": "2024-11-21T01:32:12.607",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-11-26T23:15:11.657",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2011/08/Announcing-CMSMS-1-9-4-3---Security-Release/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2011/08/Announcing-CMSMS-1-9-4-3---Security-Release/"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-12-03 21:55
Modified
2024-11-21 01:44
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2BF75ED4-BC86-4EC5-A64E-38C7915F6561",
"versionEndIncluding": "1.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BE0143D1-03F2-497B-A24D-8C989C10EFBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8B36B7B1-8A62-4A2D-A0E3-360DC56CE661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6F57C668-24A4-4E57-8737-71DD84356986",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BFDA54CA-3D5B-4D30-864B-B4227961FABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA4D26A-0FA0-4998-B8EB-23BAE3C4B6A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA77F1-B40F-4DC5-AD48-4EA403E691C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "FD39CD3A-0982-4BA3-A965-56BA06EDE972",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "262B4547-CAEB-44A0-AB42-8D51C06DC0B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B7F4228D-8EEA-49B5-B3A2-2298477BB830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1AB6A475-ADAC-4C31-9C27-C32E79E65A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "41E3BC7F-E4CD-410F-90E9-BE3352846FE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DE089F0E-CEAC-45C2-9F50-9DDDA77BA16C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C39AFF8F-8D83-4E41-BFA6-0DB4C76AB2C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05DDCE27-5140-4D88-A9BF-9D77DF0D1B7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "81464454-2834-4387-9093-679EC9F57A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98904F65-B481-455F-BF9B-CDFF8B0964B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3DDCBA15-205B-4879-8B64-F3264FD097E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2056E4B7-2528-40A4-B28E-8E4FB3E6361F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "02FEC8DD-413B-4669-BEBF-C62B9A79D70E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "418CD161-9F55-4631-A08C-08A9CF05CEC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F38D4B6-A255-4AAC-8AFF-DAB97C1B558F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "192B8763-CB7B-45AB-A5AD-1B9675CF8D06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9A313016-9EC8-4AE0-A880-D95A17BA990B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8AB70F8F-F931-4AFC-8C5C-D1A56BDA63B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3690E06D-394E-44BC-9929-B17B2734D80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AAED3443-D64D-4FF6-851C-90A99F61CCC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4D76634F-6DC4-49CD-8060-21F2ED17F652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C0FBFCAD-8850-4804-9B2A-566FDDE39685",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C94DE9A2-E9AA-43BC-8D1F-EFA97722C482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0DCBA3A6-3776-470D-BFC7-E4836D2A586F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7F327F-CA20-47C1-BF99-AB4A439EAB07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "04796760-3ED2-4B65-B571-6685916A8130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B5C6034-A597-41A6-9F1A-F3DAB63DF31C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9FE3B4A8-9C8A-46D2-A8EB-49FD3533ED3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B4AA57A0-804A-4008-A131-0DF259A5515F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "8E3417F0-EBAF-405E-A26E-F3EA570A0447",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "38CCB2E6-7722-4F23-AEF4-E720D1D63801",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98D93656-A4D2-44C4-82EC-55C8BE1A7304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BAEAE47F-5A26-474E-8F7F-72976A8FEBA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E188A80A-980F-4AD8-B3B8-21D303121F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E730A3A8-8A60-4CC5-B167-26984DE0DA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA19F5B2-7C5C-43DD-85ED-E2CD4EF6E748",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "778E5678-B763-415E-AA35-EF644E7A2CD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7DEC1EBC-1DBA-4350-8B34-7A872C62B6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "078B102C-748B-4847-8413-71659982AF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F8649F4-1A33-41AE-888F-2D6BB19BCB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "206B72EC-895E-4DA0-B41B-AAE41E53C108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC131029-CE9C-437E-B3D3-7924062E14D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF34A817-09AC-4C7E-916B-1B158C5EE599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20E8FFE1-9431-4146-AFD3-5491F5FE3C23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1016173-D980-4909-86C0-81C94711FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "068BF668-9626-4CA4-A401-1946DCF916AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA029BD9-1025-4802-BAE2-BEE218715FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9928102A-27E2-4604-93F4-318BA7CDCAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1EECFB4-7001-411F-BBAE-BABD5248E4B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40C6F2FA-0518-4B2A-9F05-51897A16AF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A35145EB-E7A7-48EC-91A9-9D423F316712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "589C199E-12F9-41CF-BFE0-4B952B773460",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7BB9992D-2EF4-4DBF-898A-6284A074403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2F14D3BD-5835-4206-BE44-72F31F46D067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "61F2E017-EEBD-473F-A15A-FD7B52A74E5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EE7E3436-2FF9-4DC6-A552-A46330220AF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C5A4D84-4C6D-453D-B1D3-2445DD7213C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC3F038-4441-4409-9384-26565F6385EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "CF32C8E8-0937-453E-9487-395331A50611",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9523997A-4302-411D-8BF2-711A28969704",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "95ED7D98-40D4-41C3-8029-EDC5A41EEBAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F744F6-DCAE-486A-BED8-F560186628C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A152CC40-72E0-4200-8670-CD99C69141EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F9B346F2-919D-4D5E-AFFF-25531AC3676E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F7C0B4EB-BA28-4BBE-8A73-926DC0B38F54",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter."
},
{
"lang": "es",
"value": "Una vulnerabilidad de falsificaci\u00f3n de peticiones en sitios cruzados (CSRF) en lib/filemanager/ImageManager/images.php en CMS Made Simple (CMSMS) v1.11.2 y anteriores permite a atacantes remotos secuestrar la autenticaci\u00f3n de los administradores de las peticiones que borran archivos de su elecci\u00f3n a trav\u00e9s del par\u00e1metro \u0027deld\u0027.\r\n"
}
],
"id": "CVE-2012-5450",
"lastModified": "2024-11-21T01:44:41.220",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-12-03T21:55:01.847",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
},
{
"source": "cve@mitre.org",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/51185"
},
{
"source": "cve@mitre.org",
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://www.htbridge.com/advisory/HTB23121"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/51185"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://www.htbridge.com/advisory/HTB23121"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-01-16 06:59
Modified
2024-11-21 02:58
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/project/changelog/5392 | Vendor Advisory | |
| cve@mitre.org | http://www.openwall.com/lists/oss-security/2017/01/16/1 | Mailing List, Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/95453 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/project/changelog/5392 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2017/01/16/1 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/95453 | Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48BE0C70-56E1-4361-8C4E-0E6B3CDB2602",
"versionEndIncluding": "2.1.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request."
},
{
"lang": "es",
"value": "Vulnerabilidad de CSRF en CMS Made Simple en versiones anteriores a 2.1.6 permite a atacantes remotos secuestrar la autenticaci\u00f3n de administradores para peticiones que crean cuentas a trav\u00e9s de una petici\u00f3n admin/adduser.php."
}
],
"id": "CVE-2016-7904",
"lastModified": "2024-11-21T02:58:40.707",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-01-16T06:59:00.133",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5392"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/16/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95453"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/5392"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/16/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/95453"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-11 19:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter."
},
{
"lang": "es",
"value": "CMS Made Simple (tambi\u00e9n conocido como CMSMS) 2.2.7 tiene Cross-Site Scripting (XSS) persistente en admin/siteprefs.php a trav\u00e9s del par\u00e1metro metadata."
}
],
"id": "CVE-2018-10033",
"lastModified": "2024-11-21T03:40:43.030",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-11T19:29:00.963",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-10-16 14:15
Modified
2024-11-21 04:32
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12149 | Exploit, Vendor Advisory | |
| cve@mitre.org | https://forum.cmsmadesimple.org/viewforum.php?f=1 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12149 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://forum.cmsmadesimple.org/viewforum.php?f=1 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.11 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D2FF3435-82A1-498B-88AE-B00DE6C31009",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the \"News \u003e Add Article\" screen."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) versi\u00f3n 2.2.11, permite un ataque de tipo XSS almacenado por parte de un administrador mediante un nombre de archivo de imagen dise\u00f1ado en la pantalla \"News ) Add Article\"."
}
],
"id": "CVE-2019-17630",
"lastModified": "2024-11-21T04:32:39.853",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-10-16T14:15:14.230",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12149"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12149"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewforum.php?f=1"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-03-05 16:37
Modified
2024-11-21 02:05
Severity ?
Summary
SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6AC509FC-2CBB-4756-A4A3-932762C0E4A7",
"versionEndIncluding": "1.11.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BE0143D1-03F2-497B-A24D-8C989C10EFBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8B36B7B1-8A62-4A2D-A0E3-360DC56CE661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6F57C668-24A4-4E57-8737-71DD84356986",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BFDA54CA-3D5B-4D30-864B-B4227961FABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA4D26A-0FA0-4998-B8EB-23BAE3C4B6A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA77F1-B40F-4DC5-AD48-4EA403E691C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "FD39CD3A-0982-4BA3-A965-56BA06EDE972",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "262B4547-CAEB-44A0-AB42-8D51C06DC0B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B7F4228D-8EEA-49B5-B3A2-2298477BB830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1AB6A475-ADAC-4C31-9C27-C32E79E65A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "41E3BC7F-E4CD-410F-90E9-BE3352846FE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DE089F0E-CEAC-45C2-9F50-9DDDA77BA16C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C39AFF8F-8D83-4E41-BFA6-0DB4C76AB2C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05DDCE27-5140-4D88-A9BF-9D77DF0D1B7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "81464454-2834-4387-9093-679EC9F57A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98904F65-B481-455F-BF9B-CDFF8B0964B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3DDCBA15-205B-4879-8B64-F3264FD097E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2056E4B7-2528-40A4-B28E-8E4FB3E6361F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "02FEC8DD-413B-4669-BEBF-C62B9A79D70E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "418CD161-9F55-4631-A08C-08A9CF05CEC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F38D4B6-A255-4AAC-8AFF-DAB97C1B558F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "192B8763-CB7B-45AB-A5AD-1B9675CF8D06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9A313016-9EC8-4AE0-A880-D95A17BA990B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8AB70F8F-F931-4AFC-8C5C-D1A56BDA63B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3690E06D-394E-44BC-9929-B17B2734D80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AAED3443-D64D-4FF6-851C-90A99F61CCC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4D76634F-6DC4-49CD-8060-21F2ED17F652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C0FBFCAD-8850-4804-9B2A-566FDDE39685",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C94DE9A2-E9AA-43BC-8D1F-EFA97722C482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0DCBA3A6-3776-470D-BFC7-E4836D2A586F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7F327F-CA20-47C1-BF99-AB4A439EAB07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "04796760-3ED2-4B65-B571-6685916A8130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B5C6034-A597-41A6-9F1A-F3DAB63DF31C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9FE3B4A8-9C8A-46D2-A8EB-49FD3533ED3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B4AA57A0-804A-4008-A131-0DF259A5515F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "8E3417F0-EBAF-405E-A26E-F3EA570A0447",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "38CCB2E6-7722-4F23-AEF4-E720D1D63801",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "4263AF5A-FE04-4EAC-87C2-03B042C0A71E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "ECB069E1-970B-456E-B477-DCD68F4CCCBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D205015-13AE-45D2-9309-3D9C90B0C3D7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "18C19AF4-A88F-4835-8A36-394637C6BD64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "578303F3-6729-45A9-8DBE-A2C393E7BB2A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "93A32CE1-85A4-417F-90D4-1378B61A45E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D63AC3D8-0297-423B-9D50-59F7B1582348",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "272A22FB-4553-47FD-88D6-B2D0C096F6EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C57412ED-477E-463D-91AB-CC02149A6E23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "B2AB67E7-4528-4AE0-9B60-DD5B1B71D17E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.5:*:*:*:*:*:*:*",
"matchCriteriaId": "5CD8DAF5-2EE2-40D2-9DFA-1D2BA749757D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.6:*:*:*:*:*:*:*",
"matchCriteriaId": "F883A9BD-A10A-4EA5-AE2C-22994D650E0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.7:*:*:*:*:*:*:*",
"matchCriteriaId": "B35E25E4-A524-43FF-923F-446DB297CE26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.8:*:*:*:*:*:*:*",
"matchCriteriaId": "2E8C4A8F-1A37-4A7B-A702-E889FF17FAF7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the \"Modify News\" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en el m\u00f3dulo News en CMS Made Simple (CMSMS) anterior a 1.11.10 permite a usuarios remotos autenticados con el permiso \"Modify News\" ejecutar comandos SQL arbitrarios a trav\u00e9s del par\u00e1metro sortby hacia admin/moduleinterface.php. NOTA: algunos de estos detalles se obtiene de informaci\u00f3n de terceras partes."
}
],
"id": "CVE-2014-2245",
"lastModified": "2024-11-21T02:05:55.210",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-03-05T16:37:41.063",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/4602"
},
{
"source": "cve@mitre.org",
"url": "http://seclists.org/oss-sec/2014/q1/467"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56996"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/65953"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/project/changelog/4602"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://seclists.org/oss-sec/2014/q1/467"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56996"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/65953"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-02-21 07:59
Modified
2024-11-21 03:29
Severity ?
Summary
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/project/files/69 | Product | |
| cve@mitre.org | https://daylight-it.com/security-advisory-dlcs0001.html | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/project/files/69 | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | https://daylight-it.com/security-advisory-dlcs0001.html | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | form_builder | * | |
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:form_builder:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D4E11B70-26B8-4C0C-A545-5CBC12AC2FFA",
"versionEndIncluding": "0.8.1.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DBC86285-74C1-45C4-B9E6-C74B992D3DC2",
"versionEndIncluding": "1.12.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form."
},
{
"lang": "es",
"value": "CMS Made Simple versi\u00f3n 1.x Form Builder antes de la versi\u00f3n 0.8.1.6 permite a atacantes remotos ejecutar c\u00f3digo PHP a trav\u00e9s del par\u00e1metro cntnt01fbrp_forma_form_template en admin_store_form."
}
],
"id": "CVE-2017-6070",
"lastModified": "2024-11-21T03:29:02.020",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-02-21T07:59:00.390",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-20 22:15
Modified
2024-11-21 08:24
Severity ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences - Add user component.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CMSmadesimple-Reflected-XSS---Add-user | Exploit, Third Party Advisory | |
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CMSmadesimple-Reflected-XSS---Add-user | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences - Add user component."
},
{
"lang": "es",
"value": "La vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado para los par\u00e1metros contrase\u00f1a y contrase\u00f1a nuevamente en My Preferences - Add user."
}
],
"id": "CVE-2023-43355",
"lastModified": "2024-11-21T08:24:02.697",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-20T22:15:10.727",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-Reflected-XSS---Add-user"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-Reflected-XSS---Add-user"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43355-CMSmadesimple-Reflected-XSS---Add-user"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-23 18:29
Modified
2024-11-21 04:15
Severity ?
Summary
In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "29313D93-1839-4062-B70D-7052DC6DF0FC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request."
},
{
"lang": "es",
"value": "En CMS Made Simple 2.2.7, un problema de salto de directorio hace que sea posible determinar la existencia de archivos y directorios fuera del directorio de instalaci\u00f3n del sitio web, as\u00ed como determinar si un archivo tiene contenidos que coincidan con una suma de verificaci\u00f3n determinada. El ataque emplea una petici\u00f3n admin/checksum.php?__c=."
}
],
"id": "CVE-2018-9921",
"lastModified": "2024-11-21T04:15:50.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-23T18:29:01.180",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://gist.github.com/0xn1k5/ef4c7c7a26c7d8a803ef3a85f1000c98"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-05-08 14:15
Modified
2025-01-29 15:15
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A892CA8E-8DF3-47E0-8A2A-FF29F9ED41D6",
"versionEndIncluding": "2.2.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file."
}
],
"id": "CVE-2021-28998",
"lastModified": "2025-01-29T15:15:10.233",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2023-05-08T14:15:10.707",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/file_upload_RCE/File_upload_to_RCE.md"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/fulldisclosure/2021/Mar/50"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/file_upload_RCE/File_upload_to_RCE.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/fulldisclosure/2021/Mar/50"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-08-14 15:15
Modified
2024-11-21 05:08
Severity ?
Summary
CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.exploit-db.com/exploits/48742 | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/48742 | Exploit, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798."
},
{
"lang": "es",
"value": "CMS Made Simple versi\u00f3n 2.2.14, permite una Carga de Archivos Arbitraria Autenticada porque el File Manager no bloquea los archivos .ptar, un problema relacionado al CVE-2017-16798."
}
],
"id": "CVE-2020-17462",
"lastModified": "2024-11-21T05:08:09.663",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-08-14T15:15:13.750",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/48742"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/48742"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-09-23 23:55
Modified
2024-11-21 01:31
Severity ?
Summary
CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.9.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "95ED7D98-40D4-41C3-8029-EDC5A41EEBAF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) v1.9.2 permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n directa a un archivo .php, lo que revela la ruta de instalaci\u00f3n en un mensaje de error, como se demostr\u00f3 con modules/TinyMCE/TinyMCE.module.php y algunos otros archivos. NOTA: esto puede superponerse a CVE-2007-5444"
}
],
"id": "CVE-2011-3718",
"lastModified": "2024-11-21T01:31:04.367",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-09-23T23:55:02.707",
"references": [
{
"source": "cve@mitre.org",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cmsmadesimple-1.9.2"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/cmsmadesimple-1.9.2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-05-08 14:15
Modified
2025-01-29 17:15
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A892CA8E-8DF3-47E0-8A2A-FF29F9ED41D6",
"versionEndIncluding": "2.2.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php."
}
],
"id": "CVE-2021-28999",
"lastModified": "2025-01-29T17:15:13.640",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2023-05-08T14:15:10.770",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/fulldisclosure/2021/Mar/49"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/fulldisclosure/2021/Mar/49"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-09-30 18:15
Modified
2024-11-21 05:13
Severity ?
Summary
CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12291 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12291 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "30146A46-BF3D-4AE4-B569-C050AC7B2745",
"versionEndExcluding": "2.2.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php."
},
{
"lang": "es",
"value": "CMS Made Simple versiones anteriores a 2.2.15, permite un ataque de tipo XSS por medio del par\u00e1metro m1_mod en una acci\u00f3n ModuleManager en la funci\u00f3n local_uninstall en archivo admin/moduleinterface.php"
}
],
"id": "CVE-2020-22842",
"lastModified": "2024-11-21T05:13:26.680",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-09-30T18:15:24.443",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12291"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12291"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-07-27 04:00
Modified
2024-11-20 23:59
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7DEC1EBC-1DBA-4350-8B34-7A872C62B6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "078B102C-748B-4847-8413-71659982AF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "9CD2DC53-EA5E-41A3-A972-EE0CBE71A8C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "AA355EC8-6FDF-44AC-93AF-3BA62F933EF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "77432D04-7A08-4897-9067-F1172C4B3444",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "77BE8ADE-AD39-429F-BF60-AE403B653FB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6DBC33E0-708B-497A-B3F7-33A525144256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "221D0520-DAF7-4812-B94B-0E3630A967EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7A477E39-3EB1-418F-9D55-E873815ADCF3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2:beta2:*:*:*:*:*:*",
"matchCriteriaId": "D2E86AAE-9DD4-426A-B004-794F6FD3571B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2:beta3:*:*:*:*:*:*",
"matchCriteriaId": "BF28FC3C-37D2-4468-A309-D5B71CA16BB3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2:beta4:*:*:*:*:*:*",
"matchCriteriaId": "264C0C12-D60B-4657-90B1-243F037F8B63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "1580903B-ED0B-4EFC-B1AF-982641D13B5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "882FBDD4-ADF3-457C-811A-DC02D0079F72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "1CA83E3C-D14C-453A-B8A4-729C910D79D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.3:beta3:*:*:*:*:*:*",
"matchCriteriaId": "3272B7A3-F5E6-469B-A308-56EDF7C831B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.3:beta4:*:*:*:*:*:*",
"matchCriteriaId": "16F2CC21-339B-4B38-AFD3-6CBA1A0BE61E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.3:beta5:*:*:*:*:*:*",
"matchCriteriaId": "DE9F185C-B41B-4E85-AB52-654738602581",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.4:beta1:*:*:*:*:*:*",
"matchCriteriaId": "C67479D1-4D79-4819-9C70-24D9B146DB12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.4:beta2:*:*:*:*:*:*",
"matchCriteriaId": "94838957-A9DC-4155-B747-696B4E49B2DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.4:beta3:*:*:*:*:*:*",
"matchCriteriaId": "CA2C53DD-CDA9-4678-A933-54CD32B6F43D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.4:beta4:*:*:*:*:*:*",
"matchCriteriaId": "BCB1C968-DE13-47E9-A0B1-E2DA1A1C8CD7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.4:beta5:*:*:*:*:*:*",
"matchCriteriaId": "439F7115-7B8F-4A95-B748-795E7D1C80A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.4_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "311645A8-2614-4D07-AC73-A164BC5BFD68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:beta_1:*:*:*:*:*:*:*",
"matchCriteriaId": "467CF107-2801-4251-9223-38536E7EAA78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:beta_2:*:*:*:*:*:*:*",
"matchCriteriaId": "0BAB9F8A-AB22-4A8F-9BF2-B58D9878B920",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencia de comandos en sitios cruzados en index.php para CMSSimple 2.4 y anteriores permite que atacantes remotos inyecten script web arbitrario o HTML mediante el par\u00e1metro \"search\" en la funci\u00f3n de b\u00fasqueda."
}
],
"id": "CVE-2005-2392",
"lastModified": "2024-11-20T23:59:27.097",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-07-27T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lostmon.blogspot.com/2005/07/cmsimple-search-variable-xss.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16147"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1014556"
},
{
"source": "cve@mitre.org",
"url": "http://www.aria-security.net/advisory/cmsimple.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.cmsimple.dk/forum/viewtopic.php?t=2470"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/18128"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/442106/100/100/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/14346"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lostmon.blogspot.com/2005/07/cmsimple-search-variable-xss.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16147"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://securitytracker.com/id?1014556"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.aria-security.net/advisory/cmsimple.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.cmsimple.dk/forum/viewtopic.php?t=2470"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/18128"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/442106/100/100/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/14346"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-20 22:15
Modified
2024-11-21 08:24
Severity ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado para el par\u00e1metro Global Meatadata en el componente del Global Settings Menu."
}
],
"id": "CVE-2023-43356",
"lastModified": "2024-11-21T08:24:02.853",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-20T22:15:10.767",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43356-CMSmadesimple-Stored-XSS---Global-Settings"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-10-08 21:00
Modified
2024-11-21 01:17
Severity ?
Summary
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A3EA8EC0-8ADB-4332-9989-30C6E16B4FB7",
"versionEndIncluding": "1.6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "5CF35F3A-634C-4C36-B3E6-F1208F9D01F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "0349FD9D-06E4-4B17-8360-003111D16A22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "E2D0D697-D088-40B1-8D80-B881A7530006",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "7F29A39F-4D8A-4683-8561-8C77B17005F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "E6C93E33-ABC4-434F-AF93-F8F697D5D62A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "36B57E13-2F90-49DD-988F-8A7F776536ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A5AAB099-B114-4A99-B086-9BA7866D4E7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "942BF218-1898-4135-9CA9-FAE4F091C883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "ACB091A6-5B3A-4C2B-9CD8-3C59549772EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "ABDA3920-B609-491E-858B-5D9CBC7F1955",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "8089FEC3-3E01-4D8E-BACB-6A42781D5151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "49DE10A7-9BC6-4B33-97FC-5FEB44AEAFBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6A607317-26A0-431B-AC83-2637CD2C5561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CD8C48F5-844F-425D-A577-C0D6D3037F76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta3:*:*:*:*:*:*",
"matchCriteriaId": "29389D5B-96DA-4889-AE13-848CD959414C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "7A575B72-7763-4BA4-A1BF-96B31203479A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98D93656-A4D2-44C4-82EC-55C8BE1A7304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BAEAE47F-5A26-474E-8F7F-72976A8FEBA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E188A80A-980F-4AD8-B3B8-21D303121F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E730A3A8-8A60-4CC5-B167-26984DE0DA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA19F5B2-7C5C-43DD-85ED-E2CD4EF6E748",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "778E5678-B763-415E-AA35-EF644E7A2CD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7DEC1EBC-1DBA-4350-8B34-7A872C62B6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "078B102C-748B-4847-8413-71659982AF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "91C39415-8F99-45FB-BE00-1888901BB4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F8649F4-1A33-41AE-888F-2D6BB19BCB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F6D11F61-8D0C-4545-9193-370D6D01ECB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta2:*:*:*:*:*:*",
"matchCriteriaId": "60F2A706-CBF1-42F5-AC04-E68C1981CCB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "206B72EC-895E-4DA0-B41B-AAE41E53C108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:beta1:*:*:*:*:*:*",
"matchCriteriaId": "A46A8B81-2D8D-431A-832A-4517E9616B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC131029-CE9C-437E-B3D3-7924062E14D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF34A817-09AC-4C7E-916B-1B158C5EE599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20E8FFE1-9431-4146-AFD3-5491F5FE3C23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1016173-D980-4909-86C0-81C94711FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "068BF668-9626-4CA4-A401-1946DCF916AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA029BD9-1025-4802-BAE2-BEE218715FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9928102A-27E2-4604-93F4-318BA7CDCAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1EECFB4-7001-411F-BBAE-BABD5248E4B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40C6F2FA-0518-4B2A-9F05-51897A16AF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A35145EB-E7A7-48EC-91A9-9D423F316712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "589C199E-12F9-41CF-BFE0-4B952B773460",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7BB9992D-2EF4-4DBF-898A-6284A074403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2F14D3BD-5835-4206-BE44-72F31F46D067",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642."
},
{
"lang": "es",
"value": "Una vulnerabilidad de salto de directorio en lib/translation.functions.php en CMS Made Simple antes de la versi\u00f3n v1.8.1 permite a atacantes remotos incluir y ejecutar archivos locales a trav\u00e9s de un .. (Punto punto) en el par\u00e1metro default_cms_lang a un script de administraci\u00f3n, tal y como se demuestra en admin/addbookmark.php. Se trata de una vulnerabilidad diferente a CVE-2008-5.642."
}
],
"id": "CVE-2010-2797",
"lastModified": "2024-11-21T01:17:23.740",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-10-08T21:00:01.987",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40031"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.cmsmadesimple.org/2010/07/3/announcing-cms-made-simple-1-8-1-mankara/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2010/08/01/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2010/08/02/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40031"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.cmsmadesimple.org/2010/07/3/announcing-cms-made-simple-1-8-1-mankara/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2010/08/01/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2010/08/02/8"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-23 22:15
Modified
2024-11-21 08:24
Severity ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu component.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News | Exploit, Third Party Advisory | |
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu component."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado en el par\u00e1metro T\u00edtulo en el componente Men\u00fa de noticias."
}
],
"id": "CVE-2023-43358",
"lastModified": "2024-11-21T08:24:03.160",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-23T22:15:09.210",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-Stored-XSS---News"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43358-CMSmadesimple-Stored-XSS---News"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-27 18:29
Modified
2024-11-21 03:41
Severity ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"module remove\" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7, la operaci\u00f3n \"module remove\" en el dashboard de administrador contiene una vulnerabilidad de eliminaci\u00f3n de archivos arbitrarios que puede provocar una denegaci\u00f3n de servicio (DoS), explotable por un usuario administrador, debido a que el atacante puede eliminar todos los archivos lib/ en todos los directorios."
}
],
"id": "CVE-2018-10520",
"lastModified": "2024-11-21T03:41:29.330",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "NONE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 9.2,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-27T18:29:00.587",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-732"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-26 17:29
Modified
2024-11-21 04:50
Severity ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DC3D9A-3D6A-4B67-8B5E-A9920555EDE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en CMS Made Simple 2.2.8. En el m\u00f3dulo News, mediante una URL manipulada, es posible lograr una inyecci\u00f3n SQL ciega basada en tiempo mediante el par\u00e1metro m1_idlist."
}
],
"id": "CVE-2019-9053",
"lastModified": "2024-11-21T04:50:53.643",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-26T17:29:01.420",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46635/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46635/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-11 18:29
Modified
2024-11-21 04:52
Severity ?
Summary
In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "492A8B19-89A9-4ED1-ACB3-77C1C9700B67",
"versionEndExcluding": "2.2.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id)."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS), en versiones anteriores a la 2.2.10, un usuario autenticado puede lograr una inyecci\u00f3n SQL en class.showtime2_data.php mediante las funciones _updateshow (par\u00e1metro show_id), _inputshow (par\u00e1metro show_id), _Getshowinfo (par\u00e1metro show_id), _Getpictureinfo (par\u00e1metro picture_id), _AdjustNameSeq (par\u00e1metro shownumber), _Updatepicture (par\u00e1metro picture_id) y Deletepicture (par\u00e1metro picture_id)."
}
],
"id": "CVE-2019-9693",
"lastModified": "2024-11-21T04:52:07.217",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-11T18:29:00.320",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php\u0026rev=47"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php\u0026rev=47"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-10-08 21:00
Modified
2024-11-21 01:19
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://secunia.com/advisories/40031 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/40031 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BBD7083A-C6D2-455D-9FA2-2A62EAA0CAB9",
"versionEndIncluding": "1.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."
},
{
"lang": "es",
"value": "Una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados en CMS Made Simple v1.8.1 y anteriores permite a atacantes remotos secuestrar la autenticaci\u00f3n de los administradores en las solicitudes que reseteo de la contrase\u00f1a de administraci\u00f3n. NOTA: la procedencia de esta informaci\u00f3n es desconocida, los detalles son obtenidos exclusivamente de la informaci\u00f3n de terceros."
}
],
"id": "CVE-2010-3884",
"lastModified": "2024-11-21T01:19:49.497",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-10-08T21:00:05.550",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40031"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40031"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-11 19:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php."
},
{
"lang": "es",
"value": "CMS Made Simple (tambi\u00e9n conocido como CMSMS) 2.2.7 tiene Cross-Site Request Forgery (CSRF) en admin/siteprefs.php."
}
],
"id": "CVE-2018-10030",
"lastModified": "2024-11-21T03:40:42.563",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-11T19:29:00.807",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-07-06 15:15
Modified
2024-11-21 08:10
Severity ?
Summary
A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.17 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FE6B0C7A-8DF5-428D-853F-B92552D8E79D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function."
}
],
"id": "CVE-2023-36970",
"lastModified": "2024-11-21T08:10:59.513",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-07-06T15:15:16.030",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://okankurtulus.com.tr/2023/06/27/cms-made-simple-v2-2-17-stored-cross-site-scripting-xss-authenticated/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://okankurtulus.com.tr/2023/06/27/cms-made-simple-v2-2-17-stored-cross-site-scripting-xss-authenticated/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-12-03 21:55
Modified
2024-11-21 01:45
Severity ?
Summary
Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2BF75ED4-BC86-4EC5-A64E-38C7915F6561",
"versionEndIncluding": "1.11.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BE0143D1-03F2-497B-A24D-8C989C10EFBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8B36B7B1-8A62-4A2D-A0E3-360DC56CE661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6F57C668-24A4-4E57-8737-71DD84356986",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BFDA54CA-3D5B-4D30-864B-B4227961FABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA4D26A-0FA0-4998-B8EB-23BAE3C4B6A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA77F1-B40F-4DC5-AD48-4EA403E691C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "FD39CD3A-0982-4BA3-A965-56BA06EDE972",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "262B4547-CAEB-44A0-AB42-8D51C06DC0B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B7F4228D-8EEA-49B5-B3A2-2298477BB830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1AB6A475-ADAC-4C31-9C27-C32E79E65A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "41E3BC7F-E4CD-410F-90E9-BE3352846FE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DE089F0E-CEAC-45C2-9F50-9DDDA77BA16C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C39AFF8F-8D83-4E41-BFA6-0DB4C76AB2C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05DDCE27-5140-4D88-A9BF-9D77DF0D1B7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "81464454-2834-4387-9093-679EC9F57A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98904F65-B481-455F-BF9B-CDFF8B0964B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3DDCBA15-205B-4879-8B64-F3264FD097E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2056E4B7-2528-40A4-B28E-8E4FB3E6361F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "02FEC8DD-413B-4669-BEBF-C62B9A79D70E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "418CD161-9F55-4631-A08C-08A9CF05CEC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F38D4B6-A255-4AAC-8AFF-DAB97C1B558F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "192B8763-CB7B-45AB-A5AD-1B9675CF8D06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9A313016-9EC8-4AE0-A880-D95A17BA990B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8AB70F8F-F931-4AFC-8C5C-D1A56BDA63B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3690E06D-394E-44BC-9929-B17B2734D80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AAED3443-D64D-4FF6-851C-90A99F61CCC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4D76634F-6DC4-49CD-8060-21F2ED17F652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C0FBFCAD-8850-4804-9B2A-566FDDE39685",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C94DE9A2-E9AA-43BC-8D1F-EFA97722C482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0DCBA3A6-3776-470D-BFC7-E4836D2A586F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7F327F-CA20-47C1-BF99-AB4A439EAB07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "04796760-3ED2-4B65-B571-6685916A8130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B5C6034-A597-41A6-9F1A-F3DAB63DF31C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9FE3B4A8-9C8A-46D2-A8EB-49FD3533ED3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B4AA57A0-804A-4008-A131-0DF259A5515F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "8E3417F0-EBAF-405E-A26E-F3EA570A0447",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "38CCB2E6-7722-4F23-AEF4-E720D1D63801",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98D93656-A4D2-44C4-82EC-55C8BE1A7304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BAEAE47F-5A26-474E-8F7F-72976A8FEBA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E188A80A-980F-4AD8-B3B8-21D303121F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E730A3A8-8A60-4CC5-B167-26984DE0DA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA19F5B2-7C5C-43DD-85ED-E2CD4EF6E748",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "778E5678-B763-415E-AA35-EF644E7A2CD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7DEC1EBC-1DBA-4350-8B34-7A872C62B6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "078B102C-748B-4847-8413-71659982AF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F8649F4-1A33-41AE-888F-2D6BB19BCB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "206B72EC-895E-4DA0-B41B-AAE41E53C108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC131029-CE9C-437E-B3D3-7924062E14D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF34A817-09AC-4C7E-916B-1B158C5EE599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20E8FFE1-9431-4146-AFD3-5491F5FE3C23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1016173-D980-4909-86C0-81C94711FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "068BF668-9626-4CA4-A401-1946DCF916AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA029BD9-1025-4802-BAE2-BEE218715FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9928102A-27E2-4604-93F4-318BA7CDCAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1EECFB4-7001-411F-BBAE-BABD5248E4B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40C6F2FA-0518-4B2A-9F05-51897A16AF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A35145EB-E7A7-48EC-91A9-9D423F316712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "589C199E-12F9-41CF-BFE0-4B952B773460",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7BB9992D-2EF4-4DBF-898A-6284A074403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2F14D3BD-5835-4206-BE44-72F31F46D067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "61F2E017-EEBD-473F-A15A-FD7B52A74E5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EE7E3436-2FF9-4DC6-A552-A46330220AF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C5A4D84-4C6D-453D-B1D3-2445DD7213C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC3F038-4441-4409-9384-26565F6385EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "CF32C8E8-0937-453E-9487-395331A50611",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9523997A-4302-411D-8BF2-711A28969704",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "95ED7D98-40D4-41C3-8029-EDC5A41EEBAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F744F6-DCAE-486A-BED8-F560186628C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A152CC40-72E0-4200-8670-CD99C69141EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F9B346F2-919D-4D5E-AFFF-25531AC3676E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F7C0B4EB-BA28-4BBE-8A73-926DC0B38F54",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en lib/filemanager/imagemanager/images.php en CMS Made Simple (CMSMS) antes de v1.11.2.1 permite a administradores autenticados remotamente borrar archivos de su elecci\u00f3n a trav\u00e9s de .. (punto punto) en el par\u00e1metro deld. NOTA: esto puede ser aprovechado mediante CSRF (CVE-2012-5450) para permitir a atacantes remotos borrar archivos arbitrarios."
}
],
"id": "CVE-2012-6064",
"lastModified": "2024-11-21T01:45:44.497",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-12-03T21:55:03.017",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
},
{
"source": "cve@mitre.org",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"source": "cve@mitre.org",
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/51185"
},
{
"source": "cve@mitre.org",
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"source": "cve@mitre.org",
"url": "https://www.htbridge.com/advisory/HTB23121"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-11/0035.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=63545"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://packetstormsecurity.org/files/117951/CMS-Made-Simple-1.11.2-Cross-Site-Request-Forgery.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/51185"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=cmsmadesimple\u0026path=%2Ftrunk%2Flib%2Ffilemanager%2FImageManager%2FClasses%2FImageManager.php\u0026rev=8400\u0026peg=8498"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79881"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.htbridge.com/advisory/HTB23121"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-01-02 17:29
Modified
2024-11-21 03:04
Severity ?
Summary
CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/ | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/ | Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * | |
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E59CF8ED-9017-4EB7-8589-1FE1CD19CA3E",
"versionEndExcluding": "2.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B9987056-FC95-4810-B117-3FFE580BBDE4",
"versionStartIncluding": "2.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution."
},
{
"lang": "es",
"value": "CMS Made Simple, en sus versiones 2.1.6 y 2.2, es vulnerable a una inyecci\u00f3n de plantillas de Smarty en algunos m\u00f3dulos centrales. Esto resulta en la ejecuci\u00f3n de c\u00f3digo PHP sin autenticaci\u00f3n."
}
],
"id": "CVE-2017-1000453",
"lastModified": "2024-11-21T03:04:45.873",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-01-02T17:29:00.820",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2017/06/Announcing-CMSMS-2-2-1-Hearts-Desire/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-74"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-01-25 16:29
Modified
2024-11-21 04:09
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://seclists.org/fulldisclosure/2018/Jan/80 | Exploit, Mailing List, Third Party Advisory | |
| cve@mitre.org | https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/ | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2018/Jan/80 | Exploit, Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/ | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB7ED7E9-D2F9-416D-B33C-C6113C1E331E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) 2.2.5 tiene Cross-Site Scripting (XSS) en admin/addbookmark.php a trav\u00e9s del par\u00e1metro title."
}
],
"id": "CVE-2018-5963",
"lastModified": "2024-11-21T04:09:45.897",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-01-25T16:29:00.527",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/80"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/146033/CMS-Made-Simple-2.2.5-Persistent-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/80"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/the-journey-begins/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-12-09 16:55
Modified
2024-11-21 01:54
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| PSIRT-CNA@flexerasoftware.com | http://secunia.com/advisories/53920 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/53920 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.11.9 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.11.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4A1B4A9B-EE73-4BDC-A4DA-966EAF49CC5C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the \"Modify Events\" permission to inject arbitrary web script or HTML via the handler parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en admin/editevent.php de CMS Made Simple (CMSMS) 1.11.9 permite a usuarios remotos autenticados con permisos de \"Modify Events\" inyectar script web o HTML arbitrario a trav\u00e9s del par\u00e1metro handler."
}
],
"id": "CVE-2013-3929",
"lastModified": "2024-11-21T01:54:33.573",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-12-09T16:55:05.030",
"references": [
{
"source": "PSIRT-CNA@flexerasoftware.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53920"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/53920"
}
],
"sourceIdentifier": "PSIRT-CNA@flexerasoftware.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-01-25 16:29
Modified
2024-11-21 04:09
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://seclists.org/fulldisclosure/2018/Jan/82 | Mailing List, Third Party Advisory | |
| cve@mitre.org | https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/ | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2018/Jan/82 | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/ | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB7ED7E9-D2F9-416D-B33C-C6113C1E331E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) 2.2.5 tiene Cross-Site Scripting (XSS) en admin/moduleinterface.php a trav\u00e9s del par\u00e1metro m1_messages."
}
],
"id": "CVE-2018-5964",
"lastModified": "2024-11-21T04:09:46.053",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-01-25T16:29:00.587",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/82"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/146034/CMS-Made-Simple-2.2.5-moduleinterface.php-title-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/82"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-05-02 23:19
Modified
2024-11-21 00:30
Severity ?
Summary
SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89D14CE0-F3D7-49E6-A767-8688466D88F6",
"versionEndIncluding": "1.0.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en el stylesheet.php del CMS Made Simple 1.0.5 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro templateid."
}
],
"evaluatorSolution": "The vendor has addressed this issue with the following product update:\r\nhttp://dev.cmsmadesimple.org/frs/?group_id=6",
"id": "CVE-2007-2473",
"lastModified": "2024-11-21T00:30:52.647",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-05-02T23:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://blog.cmsmadesimple.org/2007/04/24/cms-made-simple-106-released/"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35744"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25082"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.scanit.be/advisory-2007-05-02.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/23753"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1628"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34044"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://blog.cmsmadesimple.org/2007/04/24/cms-made-simple-106-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35744"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25082"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.scanit.be/advisory-2007-05-02.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/23753"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1628"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34044"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-03-30 12:16
Modified
2024-11-21 06:00
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12432 | Exploit, Issue Tracking, Vendor Advisory | |
| cve@mitre.org | http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12432 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.15 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "47371FA0-89B6-4625-B43D-AFC56252F4CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin \u003e My Preferences \u003e Title field."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) versi\u00f3n 2.2.15, permite un XSS autenticado por medio del script /admin/addbookmark.php a trav\u00e9s del campo Site Admin ) My Preferences ) Title."
}
],
"id": "CVE-2021-28935",
"lastModified": "2024-11-21T06:00:24.593",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-03-30T12:16:11.047",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12432"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12432"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/162287/CMS-Made-Simple-2.2.15-Cross-Site-Scripting.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-13 05:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A810FE45-F6E3-47D7-A3C9-DF05CF81DAFD",
"versionEndIncluding": "2.2.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this-\u003e_loginkey] to equal 1, because an SHA-1 cryptographic protection mechanism can be bypassed."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.6 contiene una vulnerabilidad de escalado de privilegios de usuario ordinario a usuario administrador haciendo que el valor de eff_uid en $_COOKIE[$this-\u003e_loginkey] sea igual a 1. Esto se debe a que se puede omitir un mecanismo de protecci\u00f3n criptogr\u00e1fico SHA-1."
}
],
"id": "CVE-2018-10084",
"lastModified": "2024-11-21T03:40:47.447",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-13T05:29:00.383",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-327"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-01-29 17:28
Modified
2024-11-21 00:26
Severity ?
Summary
Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "69E7A821-AB2A-47C6-BADA-52FB6A41C8FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config] and (2) pth[file][image] parameters."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de inclusi\u00f3n remota de archivo en PHP en cmsimple/cms.php de CMSimple 2.7 permiten a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n mediante una URL en el par\u00e1metro a trav\u00e9s de los par\u00e1metros (1) pth[file][config] y (2) pth[file][image]."
}
],
"id": "CVE-2007-0551",
"lastModified": "2024-11-21T00:26:09.723",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-29T17:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/33572"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2195"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/457668/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31658"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/33572"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2195"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/457668/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31658"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-03-09 09:59
Modified
2024-11-21 03:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka "Design Manager > Categories > Category Description").
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.daimacn.com/?id=7 | Exploit, Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/96933 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.daimacn.com/?id=7 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/96933 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.1.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBC308C-C925-443C-94D1-E0D3B6E6BBB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka \"Design Manager \u003e Categories \u003e Category Description\")."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en /admin/moduleinterface.php en CMS Made Simple 2.1.6 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro m1_description (vulnerabilidad tambi\u00e9n conocida como \"Design Manager \u003e Categories \u003e Category Description\")."
}
],
"id": "CVE-2017-6555",
"lastModified": "2024-11-21T03:30:01.240",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-03-09T09:59:00.300",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://www.daimacn.com/?id=7"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/96933"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://www.daimacn.com/?id=7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/96933"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-03-24 15:59
Modified
2024-11-21 03:31
Severity ?
Summary
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.03i0.com/index.php/archives/113/ | Exploit, Third Party Advisory, URL Repurposed | |
| cve@mitre.org | http://www.securityfocus.com/bid/97205 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.03i0.com/index.php/archives/113/ | Exploit, Third Party Advisory, URL Repurposed | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/97205 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.1.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBC308C-C925-443C-94D1-E0D3B6E6BBB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XSS exists in the CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" feature via the m1_content parameter. Someone must login to conduct the attack."
},
{
"lang": "es",
"value": "XSS existe en la caracter\u00edstica CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" a trav\u00e9s del par\u00e1metro m1_content. Alguien debe iniciar sesi\u00f3n para realizar el ataque."
}
],
"id": "CVE-2017-7257",
"lastModified": "2024-11-21T03:31:29.410",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-03-24T15:59:01.387",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"URL Repurposed"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/97205"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"URL Repurposed"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/97205"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-10-06 18:15
Modified
2024-11-21 04:31
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12148 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12148 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.11 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D2FF3435-82A1-498B-88AE-B00DE6C31009",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin \u003e Module Manager \u003e Search Term field."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) versi\u00f3n 2.2.11, permite un ataque de tipo XSS por medio del campo Site Admin ) Module Manager ) Search Term."
}
],
"id": "CVE-2019-17226",
"lastModified": "2024-11-21T04:31:54.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-10-06T18:15:10.197",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12148"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12148"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-26 17:29
Modified
2024-11-21 04:50
Severity ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ED903B2B-092D-46F4-9F95-6D010A45A891",
"versionEndIncluding": "2.2.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting \"sendmail\" in the \"Mailer\" option, and launching the \"Forgot your password\" feature."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en CMS Made Simple 2.2.8. Es posible, con una cuenta de administrador, inyectar comandos modificando la ruta de un ejecutable de correo electr\u00f3nico en las opciones del correo, estableciendo \"sendmail\" en la opci\u00f3n \"Mailer\" e iniciando la caracter\u00edstica \"Forgot your password\"."
}
],
"id": "CVE-2019-9059",
"lastModified": "2024-11-21T04:50:54.343",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-26T17:29:01.683",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-20 22:15
Modified
2024-11-21 08:24
Severity ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado para el par\u00e1metro adicional en el componente del men\u00fa de noticias."
}
],
"id": "CVE-2023-43353",
"lastModified": "2024-11-21T08:24:02.407",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-20T22:15:10.640",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43353-CMSmadesimple-Stored-XSS---News---Extra"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-06-05 18:29
Modified
2024-11-21 04:20
Severity ?
Summary
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://seclists.org/fulldisclosure/2019/May/36 | Exploit, Mailing List, Third Party Advisory | |
| cve@mitre.org | https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2019/May/36 | Exploit, Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "53CC645D-1656-4215-B866-0644CD48B958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has XSS via the m1_name parameter in \"Add Article\" under Content -\u003e Content Manager -\u003e News."
},
{
"lang": "es",
"value": "CMS Made Simple 2.2.10 tiene XSS a trav\u00e9s del par\u00e1metro m1_name en \"Agregar art\u00edculo\" en Contenido -\u003e Administrador de contenido -\u003e Noticias."
}
],
"id": "CVE-2019-11226",
"lastModified": "2024-11-21T04:20:45.950",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-06-05T18:29:00.683",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2019/May/36"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2019/May/36"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-10-14 18:17
Modified
2024-11-21 00:37
Severity ?
Summary
CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.1.3.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files."
},
{
"lang": "es",
"value": "CMS Made Simple 1.1.3.1 permite a atacantes remotos obtener la ruta completa mediante una petici\u00f3n directa de archivos no especificados."
}
],
"id": "CVE-2007-5444",
"lastModified": "2024-11-21T00:37:54.630",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-10-14T18:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/41033"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3223"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/41033"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3223"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-06-01 15:15
Modified
2024-11-21 05:21
Severity ?
Summary
A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12317 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12317 | Exploit, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the \u0027Setting News\u0027 module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts."
},
{
"lang": "es",
"value": "Se ha detectado una vulnerabilidad de tipo cross-site scripting (XSS) en el panel del Administrador del m\u00f3dulo \"Setting News\" en CMS Made Simple versi\u00f3n 2.2.14, que permite a un atacante ejecutar scripts web arbitrarios"
}
],
"id": "CVE-2020-27377",
"lastModified": "2024-11-21T05:21:06.680",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-06-01T15:15:07.587",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12317"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 18:15
Modified
2024-11-21 05:29
Severity ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Search Text" field under the "Admin Search" module.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Search Text\" field under the \"Admin Search\" module."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versi\u00f3n 2.2.14, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de una carga \u00fatil dise\u00f1ada introducida en el campo \"Search Text\" del m\u00f3dulo \"Admin Search\""
}
],
"id": "CVE-2020-36412",
"lastModified": "2024-11-21T05:29:26.957",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T18:15:08.860",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-10-08 21:00
Modified
2024-11-21 01:19
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C24B76E0-028C-483E-B779-EBF9C17FB9EB",
"versionEndIncluding": "1.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4D76634F-6DC4-49CD-8060-21F2ED17F652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C0FBFCAD-8850-4804-9B2A-566FDDE39685",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C94DE9A2-E9AA-43BC-8D1F-EFA97722C482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:beta5:*:*:*:*:*:*",
"matchCriteriaId": "0B2004E5-1AC3-4EDF-B160-F258769040D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C097A9F3-96A3-4893-944E-8AF89D37CED1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0DCBA3A6-3776-470D-BFC7-E4836D2A586F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7F327F-CA20-47C1-BF99-AB4A439EAB07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "04796760-3ED2-4B65-B571-6685916A8130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B7A5E24-6619-45E5-8020-3176B53E39C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:beta2:*:*:*:*:*:*",
"matchCriteriaId": "23EC4CE4-70A6-4CF8-8725-B7B811702854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B5C6034-A597-41A6-9F1A-F3DAB63DF31C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9FE3B4A8-9C8A-46D2-A8EB-49FD3533ED3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta1:*:*:*:*:*:*",
"matchCriteriaId": "146A6076-43F1-44C5-B111-29715C7A21C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta2:*:*:*:*:*:*",
"matchCriteriaId": "4FCCAF43-71C3-4AC5-A094-9F6F2DE281D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta3:*:*:*:*:*:*",
"matchCriteriaId": "71FD39E0-75EE-4735-97B5-2AE12C16B63B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "5CF35F3A-634C-4C36-B3E6-F1208F9D01F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "0349FD9D-06E4-4B17-8360-003111D16A22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "E2D0D697-D088-40B1-8D80-B881A7530006",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "7F29A39F-4D8A-4683-8561-8C77B17005F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "E6C93E33-ABC4-434F-AF93-F8F697D5D62A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "36B57E13-2F90-49DD-988F-8A7F776536ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A5AAB099-B114-4A99-B086-9BA7866D4E7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "942BF218-1898-4135-9CA9-FAE4F091C883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "ACB091A6-5B3A-4C2B-9CD8-3C59549772EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "ABDA3920-B609-491E-858B-5D9CBC7F1955",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "8089FEC3-3E01-4D8E-BACB-6A42781D5151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "49DE10A7-9BC6-4B33-97FC-5FEB44AEAFBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6A607317-26A0-431B-AC83-2637CD2C5561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CD8C48F5-844F-425D-A577-C0D6D3037F76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta3:*:*:*:*:*:*",
"matchCriteriaId": "29389D5B-96DA-4889-AE13-848CD959414C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "7A575B72-7763-4BA4-A1BF-96B31203479A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98D93656-A4D2-44C4-82EC-55C8BE1A7304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BAEAE47F-5A26-474E-8F7F-72976A8FEBA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E188A80A-980F-4AD8-B3B8-21D303121F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E730A3A8-8A60-4CC5-B167-26984DE0DA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA19F5B2-7C5C-43DD-85ED-E2CD4EF6E748",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "778E5678-B763-415E-AA35-EF644E7A2CD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7DEC1EBC-1DBA-4350-8B34-7A872C62B6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "078B102C-748B-4847-8413-71659982AF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "91C39415-8F99-45FB-BE00-1888901BB4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F8649F4-1A33-41AE-888F-2D6BB19BCB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F6D11F61-8D0C-4545-9193-370D6D01ECB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta2:*:*:*:*:*:*",
"matchCriteriaId": "60F2A706-CBF1-42F5-AC04-E68C1981CCB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "206B72EC-895E-4DA0-B41B-AAE41E53C108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:beta1:*:*:*:*:*:*",
"matchCriteriaId": "A46A8B81-2D8D-431A-832A-4517E9616B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC131029-CE9C-437E-B3D3-7924062E14D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF34A817-09AC-4C7E-916B-1B158C5EE599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20E8FFE1-9431-4146-AFD3-5491F5FE3C23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1016173-D980-4909-86C0-81C94711FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "068BF668-9626-4CA4-A401-1946DCF916AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA029BD9-1025-4802-BAE2-BEE218715FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9928102A-27E2-4604-93F4-318BA7CDCAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1EECFB4-7001-411F-BBAE-BABD5248E4B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40C6F2FA-0518-4B2A-9F05-51897A16AF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A35145EB-E7A7-48EC-91A9-9D423F316712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "589C199E-12F9-41CF-BFE0-4B952B773460",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7BB9992D-2EF4-4DBF-898A-6284A074403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B18A2D88-5B3E-4CCF-B979-F7D7A9F7EA1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2F14D3BD-5835-4206-BE44-72F31F46D067",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios (CSRF) en el modulo de cambio de permisos de grupo en CMS Made Simple v1.7.1 y anteriores permite a atacantes remotos secuestrar la autenticaci\u00f3n de los usuarios de su elecci\u00f3n en las solicitudes que hacen de modificaciones de permiso."
}
],
"id": "CVE-2010-3883",
"lastModified": "2024-11-21T01:19:49.347",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-10-08T21:00:05.503",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40031"
},
{
"source": "cve@mitre.org",
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40031"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-09-08 10:03
Modified
2024-11-21 00:00
Severity ?
Summary
PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 0.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter."
}
],
"id": "CVE-2005-2846",
"lastModified": "2024-11-21T00:00:33.040",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-09-08T10:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://forum.cmsmadesimple.org/index.php/topic%2C1549.0.html"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=112552342004406\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16654/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/14709"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://forum.cmsmadesimple.org/index.php/topic%2C1549.0.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=112552342004406\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16654/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/14709"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-01-04 11:46
Modified
2024-11-21 00:40
Severity ?
Summary
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FC758107-D88D-4AE3-89A9-D542F0C3402C",
"versionEndIncluding": "1.2.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en content_css.php del m\u00f3dulo TinyMCE para CMS Made Simple 1.2.2 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro templateid."
}
],
"id": "CVE-2007-6656",
"lastModified": "2024-11-21T00:40:41.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": true,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-01-04T11:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123/"
},
{
"source": "cve@mitre.org",
"url": "http://forum.cmsmadesimple.org/index.php/topic%2C18240.0.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/39788"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/28285"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/27074"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39311"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/4810"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://forum.cmsmadesimple.org/index.php/topic%2C18240.0.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/39788"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/28285"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/27074"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39311"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/4810"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-10-14 18:17
Modified
2024-11-21 00:37
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.1.3.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en CMS Made Simple 1.1.3.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores no especificados relacionados con (1) la etiqueta anchor (ancla) y (2) etiquetas de lista (listtags)."
}
],
"id": "CVE-2007-5443",
"lastModified": "2024-11-21T00:37:54.510",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-10-14T18:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/42471"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/42472"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3223"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/42471"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/42472"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3223"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-11 18:29
Modified
2024-11-21 04:52
Severity ?
Summary
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "492A8B19-89A9-4ED1-ACB3-77C1C9700B67",
"versionEndExcluding": "2.2.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG)."
},
{
"lang": "es",
"value": "class.showtime2_image.php en CMS Made Simple (CMSMS), en versiones anteriores a la 2.2.10, no garantiza que un archivo con marca de agua tenga una extensi\u00f3n de archivos est\u00e1ndar (GIF, JPG, JPEG o PNG)."
}
],
"id": "CVE-2019-9692",
"lastModified": "2024-11-21T04:52:07.067",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-11T18:29:00.257",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php\u0026rev=47"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46546/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46627/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2\u0026path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php\u0026rev=47"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=80285"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46546/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46627/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-12-18 06:29
Modified
2024-11-21 03:18
Severity ?
Summary
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737 | Issue Tracking, Vendor Advisory | |
| cve@mitre.org | https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=77737 | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa | Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F5942A21-0255-482E-896C-E6248A3C93C2",
"versionEndExcluding": "2.2.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) en versiones anteriores a la 2.2.5 no almacena en cach\u00e9 correctamente la informaci\u00f3n de inicio de sesi\u00f3n en las sesiones."
}
],
"id": "CVE-2017-17734",
"lastModified": "2024-11-21T03:18:32.883",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-12-18T06:29:00.193",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://forum.cmsmadesimple.org/viewtopic.php?f=1\u0026t=77737"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2017/12/Announcing-CMSMS-v2.2.5-Wawa"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-26 21:15
Modified
2024-11-21 05:13
Severity ?
Summary
Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12321 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12321 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross Site Scripting (XSS) en CMS Made Simple versi\u00f3n 2.2.14 por medio del campo Logic en la funcionalidad Content Manager"
}
],
"id": "CVE-2020-23240",
"lastModified": "2024-11-21T05:13:39.970",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-26T21:15:16.577",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12321"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12321"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-24 22:29
Modified
2024-11-21 04:18
Severity ?
Summary
CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12001 | Exploit, Vendor Advisory | |
| cve@mitre.org | https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/ | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12001 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/ | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "53CC645D-1656-4215-B866-0644CD48B958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an \"Add a new Profile\" action to the File Picker."
},
{
"lang": "es",
"value": "CMS Made Simple 2.2.10 tiene Cross-Site Scripting (XSS) mediante el campo Name en moduleinterface.php, que es alcanzable mediante la acci\u00f3n \"Add a new Profile\" en el File Picker."
}
],
"id": "CVE-2019-10017",
"lastModified": "2024-11-21T04:18:13.763",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-24T22:29:00.347",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12001"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12001"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://ctrsec.io/index.php/2019/03/24/cmsmadesimple-xss-filepicker/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-08-05 17:15
Modified
2024-11-21 05:13
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12288 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12288 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions \u003e Fie Picker.."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) versi\u00f3n 2.2.14, permite un ataque de tipo XSS almacenado por medio de las Extensiones ) Fie Picker.."
}
],
"id": "CVE-2020-22732",
"lastModified": "2024-11-21T05:13:23.667",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-05T17:15:07.100",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12288"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12288"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-03-24 15:59
Modified
2024-11-21 03:31
Severity ?
Summary
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.03i0.com/index.php/archives/113/ | Exploit, Third Party Advisory, URL Repurposed | |
| cve@mitre.org | http://www.securityfocus.com/bid/97203 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.03i0.com/index.php/archives/113/ | Exploit, Third Party Advisory, URL Repurposed | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/97203 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.1.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBC308C-C925-443C-94D1-E0D3B6E6BBB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XSS exists in the CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" feature via the m1_title parameter. Someone must login to conduct the attack."
},
{
"lang": "es",
"value": "XSS existe en la caracter\u00edstica CMS Made Simple (CMSMS) 2.1.6 \"Content--\u003eNews--\u003eAdd Article\" a trav\u00e9s del par\u00e1metro m1_title. Alguien debe iniciar sesi\u00f3n para realizar el ataque."
}
],
"id": "CVE-2017-7255",
"lastModified": "2024-11-21T03:31:29.103",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-03-24T15:59:01.327",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"URL Repurposed"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/97203"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"URL Repurposed"
],
"url": "http://www.03i0.com/index.php/archives/113/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/97203"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-10-14 18:17
Modified
2024-11-21 00:37
Severity ?
Summary
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an "admin/adminlog.php?page=1" request.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.1.3.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an \"admin/adminlog.php?page=1\" request."
},
{
"lang": "es",
"value": "CMS Made Simple 1.1.3.1 no comprueba los permisos asignados a los usuarios en algunas situaciones, lo cual permite a usuarios remotos autenticados llevar a cabo algunas acciones administrativas, como se ha demostrado (1) a\u00f1adiendo un usuario mediante una petici\u00f3n directa a admin/adduser.php y (2) leyendo el archivo de registro de administraci\u00f3n mediante una petici\u00f3n \"admin/adminlog.php?page=1\"."
}
],
"id": "CVE-2007-5441",
"lastModified": "2024-11-21T00:37:54.247",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-10-14T18:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/45481"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3223"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/45481"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3223"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-07-18 00:29
Modified
2024-11-21 03:07
Severity ?
Summary
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "374F6E2F-C2A4-46D4-9932-FCE2FFFFAB07",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS) versi\u00f3n 2.2.2, los administradores autenticados remotos pueden cargar un archivo .php por medio de una acci\u00f3n FileManager en el archivo admin/moduleinterface.php."
}
],
"id": "CVE-2017-11404",
"lastModified": "2024-11-21T03:07:43.187",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-07-18T00:29:00.247",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-01-25 16:29
Modified
2024-11-21 04:09
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| cve@mitre.org | http://seclists.org/fulldisclosure/2018/Jan/83 | Exploit, Mailing List, Third Party Advisory | |
| cve@mitre.org | https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/ | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html | Exploit, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2018/Jan/83 | Exploit, Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/ | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.5 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB7ED7E9-D2F9-416D-B33C-C6113C1E331E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) 2.2.5 tiene Cross-Site Scripting (XSS) en admin/moduleinterface.php a trav\u00e9s del par\u00e1metro m1_errors."
}
],
"id": "CVE-2018-5965",
"lastModified": "2024-11-21T04:09:46.210",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-01-25T16:29:00.637",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/83"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/146035/CMS-Made-Simple-2.2.5-moduleinterface.php-m1_errors-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2018/Jan/83"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://kyawminthein901497298.wordpress.com/2018/01/22/cms-made-simple-2-2-5-reflected-cross-site-scripting/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-03-02 17:55
Modified
2024-11-21 02:01
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B439441E-3421-44BA-BBD0-4D23C582AD00",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de XSS en CMS Made Simple permiten a usuarios remotos autenticados intectar script Web o HTML arbitrarios a trav\u00e9s de (1) el par\u00e1metro group hacia admin/addgroup.php, (2) el par\u00e1metro htmlblob hacia admin/addhtmlblob.php, el (3) t\u00edtulo o (4) par\u00e1metro url hacia admin/addbookmark.php, (5) el par\u00e1metro stylesheet_name hacia admin/copystylesheet.php, (6) el par\u00e1metro template_name hacia admin/copytemplate.php, el (7) t\u00edtulo o (8) par\u00e1metro url hacia admin/editbookmark.php, (9) el par\u00e1metro template hacia admin/listtemplates.php o (10) el par\u00e1metro css_name hacia admin/listcss.php, un problema diferente a CVE-2014-2092."
}
],
"id": "CVE-2014-0334",
"lastModified": "2024-11-21T02:01:54.043",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-03-02T17:55:02.720",
"references": [
{
"source": "cret@cert.org",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/526062"
},
{
"source": "cret@cert.org",
"url": "http://www.securityfocus.com/bid/65898"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/526062"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/65898"
}
],
"sourceIdentifier": "cret@cert.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-13 05:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7 permite el filtrado de la ruta f\u00edsica mediante un valor /index.php?page= no v\u00e1lido, un URI manipulado que comience por /index.php?mact=Search o una petici\u00f3n directa a /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php op /lib/tasks/class.CmsSecurityCheck.task.php."
}
],
"id": "CVE-2018-10082",
"lastModified": "2024-11-21T03:40:47.160",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-13T05:29:00.277",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-04-11 20:29
Modified
2024-11-21 04:50
Severity ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Vendor Advisory | |
| cve@mitre.org | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DC3D9A-3D6A-4B67-8B5E-A9920555EDE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection."
},
{
"lang": "es",
"value": "Se detecto un problema en CMS Made Simple versi\u00f3n 2.2.8. En el m\u00f3dulo FrontEndUsers (en el archivo class.FrontEndUsersManipulate.php o class.FrontEndUsersManipulator.php), es posible lograr una llamada no serializada con una cookie no confiable __FEU__ , y conseguir una inyecci\u00f3n de objeto autenticada."
}
],
"id": "CVE-2019-9056",
"lastModified": "2024-11-21T04:50:53.930",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-11T20:29:00.790",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-07-06 15:15
Modified
2024-11-21 08:10
Severity ?
Summary
CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.17 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FE6B0C7A-8DF5-428D-853F-B92552D8E79D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function."
}
],
"id": "CVE-2023-36969",
"lastModified": "2024-11-21T08:10:59.367",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-07-06T15:15:15.983",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://okankurtulus.com.tr/2023/06/26/cms-made-simple-v2-2-17-file-upload-remote-code-execution-rce-authenticated/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://okankurtulus.com.tr/2023/06/26/cms-made-simple-v2-2-17-file-upload-remote-code-execution-rce-authenticated/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-09-28 14:15
Modified
2024-11-21 08:24
Severity ?
Summary
A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS)."
},
{
"lang": "es",
"value": "Vulnerabilidad de carga de archivos en CMSmadesimple v.2.2.18 permite a un atacante local cargar un archivo pdf con Cross Site Scripting (XSS) oculto."
}
],
"id": "CVE-2023-43872",
"lastModified": "2024-11-21T08:24:56.097",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-09-28T14:15:24.320",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CMSmadesimple-File-Upload--XSS---File-Manager"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-11 19:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/zxyxx/cmsms_vul | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter."
},
{
"lang": "es",
"value": "CMS Made Simple (tambi\u00e9n conocido como CMSMS) 2.2.7 tiene Cross-Site Scripting (XSS) reflejado en admin/moduleinterface.php a trav\u00e9s del par\u00e1metro m1_version."
}
],
"id": "CVE-2018-10032",
"lastModified": "2024-11-21T03:40:42.890",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-11T19:29:00.917",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/zxyxx/cmsms_vul"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-06-18 21:29
Modified
2024-11-21 03:36
Severity ?
Summary
In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/XiaoZhis/ProjectSend/issues/2 | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/XiaoZhis/ProjectSend/issues/2 | Issue Tracking, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.1.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBC308C-C925-443C-94D1-E0D3B6E6BBB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In admin\\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action."
},
{
"lang": "es",
"value": "En admin\\addgroup.php en el gestor de contenidos Made Simple 2.1.6, cuando se a\u00f1ade un nuevo grupo no filtra el XSS resultando en la generaci\u00f3n de un Storage-type XSS, mediante el parametro de descripci\u00f3n en la acci\u00f3n de a\u00f1adir grupo."
}
],
"id": "CVE-2017-9668",
"lastModified": "2024-11-21T03:36:36.740",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-06-18T21:29:00.177",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/XiaoZhis/ProjectSend/issues/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/XiaoZhis/ProjectSend/issues/2"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-03-12 03:29
Modified
2024-11-21 04:13
Severity ?
Summary
CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2A1B9E5B-97A3-467D-8B86-EFD31F2FD82C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) 2.2.6 tiene Cross-Site Scripting (XSS) en admin/moduleinterface.php mediante el par\u00e1metro pagedata."
}
],
"id": "CVE-2018-8058",
"lastModified": "2024-11-21T04:13:12.143",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-03-12T03:29:00.400",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/ibey0nd/CVE/blob/master/CMS%20Made%20Simple%20Stored%20XSS%202.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-26 17:29
Modified
2024-11-21 04:50
Severity ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Release Notes, Vendor Advisory | |
| cve@mitre.org | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg | Release Notes, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum | Release Notes, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ED903B2B-092D-46F4-9F95-6D010A45A891",
"versionEndIncluding": "2.2.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en CMS Made Simple 2.2.8. En la p\u00e1gina de administrador en admin/changegroupperm.php, es posible enviar un valor manipulado en el par\u00e1metro sel_groups que conduce a una inyecci\u00f3n de objetos autenticada."
}
],
"id": "CVE-2019-9058",
"lastModified": "2024-11-21T04:50:54.203",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-26T17:29:01.607",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1321"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-26 22:29
Modified
2024-11-21 04:18
Severity ?
Summary
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12004 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12004 | Exploit, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "53CC645D-1656-4215-B866-0644CD48B958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has XSS via the \u0027moduleinterface.php\u0027 Name field, which is reachable via an \"Add Category\" action to the \"Site Admin Settings - News module\" section."
},
{
"lang": "es",
"value": "CMS Made Simple 2.2.10 tiene Cross-Site Scripting (XSS) mediante el campo \"Name\" en moduleinterface.php, que es alcanzable mediante la acci\u00f3n \"Add Category\" en la secci\u00f3n \"Site Admin Settings - News module\"."
}
],
"id": "CVE-2019-10106",
"lastModified": "2024-11-21T04:18:25.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-26T22:29:00.567",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12004"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12004"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-26 22:29
Modified
2024-11-21 04:18
Severity ?
Summary
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12002 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12002 | Exploit, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "53CC645D-1656-4215-B866-0644CD48B958",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager \"Name\" field, which is reachable via a \"Create a new Template\" action to the Design Manager."
},
{
"lang": "es",
"value": "CMS Made Simple 2.2.10 tiene una vulnerabilidad de auto Cross-Site Scripting (XSS) mediante el campo Name del Gestor de Dise\u00f1o de Distribuci\u00f3n, que es alcanzable mediante la acci\u00f3n \"Create a new Template\" en el Gestor de Dise\u00f1o."
}
],
"id": "CVE-2019-10105",
"lastModified": "2024-11-21T04:18:25.050",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-26T22:29:00.520",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12002"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12002"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-10-12 19:29
Modified
2024-11-21 03:55
Severity ?
Summary
XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12 | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12 | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.7 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "29313D93-1839-4062-B70D-7052DC6DF0FC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php \"Content--\u003eNews--\u003eAdd Article\" action."
},
{
"lang": "es",
"value": "Existe Cross-Site Scripting (XSS) en CMS Made Simple 2.2.7 mediante el par\u00e1metro m1_news_url en una acci\u00f3n \"Content--\u003eNews--\u003eAdd Article\" en admin/moduleinterface.php."
}
],
"id": "CVE-2018-18270",
"lastModified": "2024-11-21T03:55:37.763",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-10-12T19:29:00.280",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-10-14 18:17
Modified
2024-11-21 00:37
Severity ?
Summary
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.1.3.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors."
},
{
"lang": "es",
"value": "CMS Made Simple 1.1.3.1 no comprueba los permisos asignados a los usuarios que intentan enviar archivos, lo cual permite a usuarios autenticados remotamente enviar archivos no especificados a trav\u00e9s de vectores desconocidos."
}
],
"id": "CVE-2007-5442",
"lastModified": "2024-11-21T00:37:54.383",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-10-14T18:17:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3223"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3223"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/481984/100/0/threaded"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-04-11 10:39
Modified
2024-11-21 01:38
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "68232241-1C43-4246-A445-58A52D27E45C",
"versionEndIncluding": "1.10.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BE0143D1-03F2-497B-A24D-8C989C10EFBA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8B36B7B1-8A62-4A2D-A0E3-360DC56CE661",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6F57C668-24A4-4E57-8737-71DD84356986",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BFDA54CA-3D5B-4D30-864B-B4227961FABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2CA4D26A-0FA0-4998-B8EB-23BAE3C4B6A8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA77F1-B40F-4DC5-AD48-4EA403E691C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "FD39CD3A-0982-4BA3-A965-56BA06EDE972",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "262B4547-CAEB-44A0-AB42-8D51C06DC0B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B7F4228D-8EEA-49B5-B3A2-2298477BB830",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1AB6A475-ADAC-4C31-9C27-C32E79E65A85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "41E3BC7F-E4CD-410F-90E9-BE3352846FE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DE089F0E-CEAC-45C2-9F50-9DDDA77BA16C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C39AFF8F-8D83-4E41-BFA6-0DB4C76AB2C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "05DDCE27-5140-4D88-A9BF-9D77DF0D1B7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "81464454-2834-4387-9093-679EC9F57A00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98904F65-B481-455F-BF9B-CDFF8B0964B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "3DDCBA15-205B-4879-8B64-F3264FD097E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2056E4B7-2528-40A4-B28E-8E4FB3E6361F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "02FEC8DD-413B-4669-BEBF-C62B9A79D70E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "418CD161-9F55-4631-A08C-08A9CF05CEC0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1F38D4B6-A255-4AAC-8AFF-DAB97C1B558F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "192B8763-CB7B-45AB-A5AD-1B9675CF8D06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9A313016-9EC8-4AE0-A880-D95A17BA990B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8AB70F8F-F931-4AFC-8C5C-D1A56BDA63B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3690E06D-394E-44BC-9929-B17B2734D80A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AAED3443-D64D-4FF6-851C-90A99F61CCC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4D76634F-6DC4-49CD-8060-21F2ED17F652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C0FBFCAD-8850-4804-9B2A-566FDDE39685",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C94DE9A2-E9AA-43BC-8D1F-EFA97722C482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:beta5:*:*:*:*:*:*",
"matchCriteriaId": "0B2004E5-1AC3-4EDF-B160-F258769040D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C097A9F3-96A3-4893-944E-8AF89D37CED1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0DCBA3A6-3776-470D-BFC7-E4836D2A586F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7F327F-CA20-47C1-BF99-AB4A439EAB07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "04796760-3ED2-4B65-B571-6685916A8130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B7A5E24-6619-45E5-8020-3176B53E39C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:beta2:*:*:*:*:*:*",
"matchCriteriaId": "23EC4CE4-70A6-4CF8-8725-B7B811702854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B5C6034-A597-41A6-9F1A-F3DAB63DF31C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9FE3B4A8-9C8A-46D2-A8EB-49FD3533ED3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B4AA57A0-804A-4008-A131-0DF259A5515F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta1:*:*:*:*:*:*",
"matchCriteriaId": "146A6076-43F1-44C5-B111-29715C7A21C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta2:*:*:*:*:*:*",
"matchCriteriaId": "4FCCAF43-71C3-4AC5-A094-9F6F2DE281D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta3:*:*:*:*:*:*",
"matchCriteriaId": "71FD39E0-75EE-4735-97B5-2AE12C16B63B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "5CF35F3A-634C-4C36-B3E6-F1208F9D01F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "0349FD9D-06E4-4B17-8360-003111D16A22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "E2D0D697-D088-40B1-8D80-B881A7530006",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "7F29A39F-4D8A-4683-8561-8C77B17005F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "E6C93E33-ABC4-434F-AF93-F8F697D5D62A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "36B57E13-2F90-49DD-988F-8A7F776536ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A5AAB099-B114-4A99-B086-9BA7866D4E7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "942BF218-1898-4135-9CA9-FAE4F091C883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "ACB091A6-5B3A-4C2B-9CD8-3C59549772EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "ABDA3920-B609-491E-858B-5D9CBC7F1955",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "8089FEC3-3E01-4D8E-BACB-6A42781D5151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "8E3417F0-EBAF-405E-A26E-F3EA570A0447",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "38CCB2E6-7722-4F23-AEF4-E720D1D63801",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "49DE10A7-9BC6-4B33-97FC-5FEB44AEAFBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6A607317-26A0-431B-AC83-2637CD2C5561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CD8C48F5-844F-425D-A577-C0D6D3037F76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta3:*:*:*:*:*:*",
"matchCriteriaId": "29389D5B-96DA-4889-AE13-848CD959414C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "7A575B72-7763-4BA4-A1BF-96B31203479A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98D93656-A4D2-44C4-82EC-55C8BE1A7304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BAEAE47F-5A26-474E-8F7F-72976A8FEBA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E188A80A-980F-4AD8-B3B8-21D303121F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E730A3A8-8A60-4CC5-B167-26984DE0DA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA19F5B2-7C5C-43DD-85ED-E2CD4EF6E748",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "778E5678-B763-415E-AA35-EF644E7A2CD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7DEC1EBC-1DBA-4350-8B34-7A872C62B6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "078B102C-748B-4847-8413-71659982AF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "91C39415-8F99-45FB-BE00-1888901BB4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F8649F4-1A33-41AE-888F-2D6BB19BCB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F6D11F61-8D0C-4545-9193-370D6D01ECB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta2:*:*:*:*:*:*",
"matchCriteriaId": "60F2A706-CBF1-42F5-AC04-E68C1981CCB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "206B72EC-895E-4DA0-B41B-AAE41E53C108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:beta1:*:*:*:*:*:*",
"matchCriteriaId": "A46A8B81-2D8D-431A-832A-4517E9616B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC131029-CE9C-437E-B3D3-7924062E14D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF34A817-09AC-4C7E-916B-1B158C5EE599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20E8FFE1-9431-4146-AFD3-5491F5FE3C23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1016173-D980-4909-86C0-81C94711FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "068BF668-9626-4CA4-A401-1946DCF916AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA029BD9-1025-4802-BAE2-BEE218715FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9928102A-27E2-4604-93F4-318BA7CDCAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1EECFB4-7001-411F-BBAE-BABD5248E4B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40C6F2FA-0518-4B2A-9F05-51897A16AF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A35145EB-E7A7-48EC-91A9-9D423F316712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "589C199E-12F9-41CF-BFE0-4B952B773460",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7BB9992D-2EF4-4DBF-898A-6284A074403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B18A2D88-5B3E-4CCF-B979-F7D7A9F7EA1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2F14D3BD-5835-4206-BE44-72F31F46D067",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "61F2E017-EEBD-473F-A15A-FD7B52A74E5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "EE7E3436-2FF9-4DC6-A552-A46330220AF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "8C5A4D84-4C6D-453D-B1D3-2445DD7213C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "4EC3F038-4441-4409-9384-26565F6385EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "CF32C8E8-0937-453E-9487-395331A50611",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9523997A-4302-411D-8BF2-711A28969704",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "95ED7D98-40D4-41C3-8029-EDC5A41EEBAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D3F744F6-DCAE-486A-BED8-F560186628C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A152CC40-72E0-4200-8670-CD99C69141EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F9B346F2-919D-4D5E-AFFF-25531AC3676E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F7C0B4EB-BA28-4BBE-8A73-926DC0B38F54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.9.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "2DA09626-9C30-4FAB-82A6-A7D5903127BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "4263AF5A-FE04-4EAC-87C2-03B042C0A71E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10.1:*:*:*:*:*:*:*",
"matchCriteriaId": "ECB069E1-970B-456E-B477-DCD68F4CCCBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.10.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0D205015-13AE-45D2-9309-3D9C90B0C3D7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template)."
},
{
"lang": "es",
"value": "Una vulnerabilidad de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en admin/edituser.php en CMS Made Simple v1.10.3 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro de correo electr\u00f3nico (tambi\u00e9n conocido como el campo Direcci\u00f3n de correo electr\u00f3nico del usuario en la plantilla de edici\u00f3n)."
}
],
"id": "CVE-2012-1992",
"lastModified": "2024-11-21T01:38:15.227",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-04-11T10:39:27.107",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/52850"
},
{
"source": "cve@mitre.org",
"url": "http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52850"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-06-09 15:15
Modified
2024-11-21 06:25
Severity ?
Summary
CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A892CA8E-8DF3-47E0-8A2A-FF29F9ED41D6",
"versionEndIncluding": "2.2.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple \u003c=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the \u0027."
},
{
"lang": "es",
"value": "CMS Made Simple versiones anteriores a 2.2.15 incluy\u00e9ndola, est\u00e1 afectado por una inyecci\u00f3n SQL en el archivomodules/News/function.admin_articlestab.php. La variable $sortby est\u00e1 concatenada con $query1, pero es posible inyectar un lenguaje SQL arbitrario sin usar la variable \""
}
],
"id": "CVE-2021-40961",
"lastModified": "2024-11-21T06:25:09.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-09T15:15:09.187",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/161895/CMS-Made-Simple-2.2.15-SQL-Injection.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/fulldisclosure/2021/Mar/49"
},
{
"source": "cve@mitre.org",
"url": "https://www.soteritsecurity.com/blog/2023/01/CMS-Made-Simple_CVE-2021-40961.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://packetstormsecurity.com/files/161895/CMS-Made-Simple-2.2.15-SQL-Injection.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "https://seclists.org/fulldisclosure/2021/Mar/49"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.soteritsecurity.com/blog/2023/01/CMS-Made-Simple_CVE-2021-40961.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-03-26 17:29
Modified
2024-11-21 04:50
Severity ?
Summary
An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ED903B2B-092D-46F4-9F95-6D010A45A891",
"versionEndIncluding": "2.2.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection."
},
{
"lang": "es",
"value": "Se ha descubierto un problema en CMS Made Simple 2.2.8. En el m\u00f3dulo DesignManager (en los archivos action.admin_bulk_css.php y action.admin_bulk_template.php), con un usuario sin privilegios con el permiso Designer, es posible alcanzar una llamada no serializada con un valor manipulado en el par\u00e1metro m1_allparms y lograr inyectar objetos."
}
],
"id": "CVE-2019-9055",
"lastModified": "2024-11-21T04:50:53.787",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-03-26T17:29:01.467",
"references": [
{
"source": "cve@mitre.org",
"url": "http://packetstormsecurity.com/files/155322/CMS-Made-Simple-2.2.8-Remote-Code-Execution.html"
},
{
"source": "cve@mitre.org",
"url": "https://blog.certimetergroup.com/it/articolo/security/CMS_Made_Simple_deserialization_attack_%28CVE-2019-9055%29"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://packetstormsecurity.com/files/155322/CMS-Made-Simple-2.2.8-Remote-Code-Execution.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://blog.certimetergroup.com/it/articolo/security/CMS_Made_Simple_deserialization_attack_%28CVE-2019-9055%29"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-01-02 17:29
Modified
2024-11-21 03:04
Severity ?
Summary
CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://www.cmsmadesimple.org/2017/07/Announcing-CMSMS-2.2.2-Hearts-Content | Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cmsmadesimple.org/2017/07/Announcing-CMSMS-2.2.2-Hearts-Content | Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * | |
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E59CF8ED-9017-4EB7-8589-1FE1CD19CA3E",
"versionEndExcluding": "2.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B9987056-FC95-4810-B117-3FFE580BBDE4",
"versionStartIncluding": "2.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1"
},
{
"lang": "es",
"value": "CMS Made Simple 2.1.6, 2.2 y 2.2.1 es vulnerable a una inyecci\u00f3n de plantillas de Smarty en algunos componentes centrales. Esto resulta en la lectura de archivos locales en versiones anteriores a la 2.2 y en la inclusi\u00f3n de archivos locales desde la versi\u00f3n 2.2.1."
}
],
"id": "CVE-2017-1000454",
"lastModified": "2024-11-21T03:04:46.017",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-01-02T17:29:00.963",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2017/07/Announcing-CMSMS-2.2.2-Hearts-Content"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://www.cmsmadesimple.org/2017/07/Announcing-CMSMS-2.2.2-Hearts-Content"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-74"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-12-25 23:29
Modified
2024-11-21 04:01
Severity ?
Summary
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/Xmansec/cmsms_vul | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/Xmansec/cmsms_vul | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DC3D9A-3D6A-4B67-8B5E-A9920555EDE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user\u0027s mailbox with the wrong format. The response contains the user\u0027s previously entered email address."
},
{
"lang": "es",
"value": "Hay una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en CMS Made Simple 2.2.8, en admin/myaccount.php. Esta vulnerabilidad se desencadena tras un intento de modificaci\u00f3n de la bandeja de entrada de un usuario con el formato err\u00f3neo. La respuesta contiene la direcci\u00f3n de email previamente introducida por el usuario."
}
],
"id": "CVE-2018-20464",
"lastModified": "2024-11-21T04:01:32.453",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-12-25T23:29:00.277",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Xmansec/cmsms_vul"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Xmansec/cmsms_vul"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-05-12 07:29
Modified
2024-11-21 03:34
Severity ?
Summary
CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/ | Issue Tracking, Patch, Third Party Advisory | |
| cve@mitre.org | https://www.exploit-db.com/exploits/41997/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/ | Issue Tracking, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.exploit-db.com/exploits/41997/ |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.1.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "BCBC308C-C925-443C-94D1-E0D3B6E6BBB4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is \"a feature, not a bug."
},
{
"lang": "es",
"value": "** EN DISPUTA** CMS Made Simple (CMSMS) 2.1.6 permite a los administradores autenticados remotos ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s del par\u00e1metro de c\u00f3digo admin/editusertag.php, relativo a las funciones CreateTagFunction y CallUserTag. NOTA: el vendedor ha declarado que esto es \"una caracter\u00edstica, no un error\"."
}
],
"id": "CVE-2017-8912",
"lastModified": "2024-11-21T03:34:57.587",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2017-05-12T07:29:00.343",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/41997/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/41997/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-10-08 21:00
Modified
2024-11-21 01:19
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add Field Definition, or (7) Add Shortcut module.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C24B76E0-028C-483E-B779-EBF9C17FB9EB",
"versionEndIncluding": "1.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "B87A7B4D-FB2C-4896-BF22-76F5D16A995E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.3:*:*:*:*:*:*:*",
"matchCriteriaId": "4D76634F-6DC4-49CD-8060-21F2ED17F652",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.10.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C0FBFCAD-8850-4804-9B2A-566FDDE39685",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C94DE9A2-E9AA-43BC-8D1F-EFA97722C482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:beta5:*:*:*:*:*:*",
"matchCriteriaId": "0B2004E5-1AC3-4EDF-B160-F258769040D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11:beta6:*:*:*:*:*:*",
"matchCriteriaId": "C097A9F3-96A3-4893-944E-8AF89D37CED1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0DCBA3A6-3776-470D-BFC7-E4836D2A586F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.11.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7F327F-CA20-47C1-BF99-AB4A439EAB07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "04796760-3ED2-4B65-B571-6685916A8130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6B7A5E24-6619-45E5-8020-3176B53E39C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12:beta2:*:*:*:*:*:*",
"matchCriteriaId": "23EC4CE4-70A6-4CF8-8725-B7B811702854",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2B5C6034-A597-41A6-9F1A-F3DAB63DF31C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.12.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9FE3B4A8-9C8A-46D2-A8EB-49FD3533ED3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta1:*:*:*:*:*:*",
"matchCriteriaId": "146A6076-43F1-44C5-B111-29715C7A21C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta2:*:*:*:*:*:*",
"matchCriteriaId": "4FCCAF43-71C3-4AC5-A094-9F6F2DE281D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:0.13:beta3:*:*:*:*:*:*",
"matchCriteriaId": "71FD39E0-75EE-4735-97B5-2AE12C16B63B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "43F7E5BD-553E-4731-BED1-7E7DB772AD82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "5CF35F3A-634C-4C36-B3E6-F1208F9D01F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "0349FD9D-06E4-4B17-8360-003111D16A22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "E2D0D697-D088-40B1-8D80-B881A7530006",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "7F29A39F-4D8A-4683-8561-8C77B17005F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta5:*:*:*:*:*:*",
"matchCriteriaId": "E6C93E33-ABC4-434F-AF93-F8F697D5D62A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0:beta6:*:*:*:*:*:*",
"matchCriteriaId": "36B57E13-2F90-49DD-988F-8A7F776536ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "F4BF3B2C-1909-4CCF-A487-6378615D6A4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5AB06C16-336C-4D85-84F6-24F079A2B144",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB1C531-AA30-4B89-A8BF-744B053B4983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "DD0AE7F4-49F8-443A-9C8F-2F1C42F46713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0203A997-A077-4A8A-A3FE-CA9D10FF43AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "A5AAB099-B114-4A99-B086-9BA7866D4E7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "942BF218-1898-4135-9CA9-FAE4F091C883",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "574E610A-4799-45C9-B005-C1593B033AD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "ACB091A6-5B3A-4C2B-9CD8-3C59549772EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "ABDA3920-B609-491E-858B-5D9CBC7F1955",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "8089FEC3-3E01-4D8E-BACB-6A42781D5151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3F3B9680-3A66-4508-A318-B9B348FDC222",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9BDADD27-8249-4DE3-A2B5-EE1A3AD73F28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "87178F45-424A-47D8-BEA5-B8371B722CC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "49DE10A7-9BC6-4B33-97FC-5FEB44AEAFBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A2FA0450-91E6-4250-A1D1-F2CFBB74A5B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta1:*:*:*:*:*:*",
"matchCriteriaId": "6A607317-26A0-431B-AC83-2637CD2C5561",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta2:*:*:*:*:*:*",
"matchCriteriaId": "CD8C48F5-844F-425D-A577-C0D6D3037F76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:beta3:*:*:*:*:*:*",
"matchCriteriaId": "29389D5B-96DA-4889-AE13-848CD959414C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "7A575B72-7763-4BA4-A1BF-96B31203479A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "98D93656-A4D2-44C4-82EC-55C8BE1A7304",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BAEAE47F-5A26-474E-8F7F-72976A8FEBA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E188A80A-980F-4AD8-B3B8-21D303121F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "E730A3A8-8A60-4CC5-B167-26984DE0DA3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FA19F5B2-7C5C-43DD-85ED-E2CD4EF6E748",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "778E5678-B763-415E-AA35-EF644E7A2CD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta1:*:*:*:*:*:*",
"matchCriteriaId": "7DEC1EBC-1DBA-4350-8B34-7A872C62B6BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3:beta2:*:*:*:*:*:*",
"matchCriteriaId": "078B102C-748B-4847-8413-71659982AF01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "91C39415-8F99-45FB-BE00-1888901BB4D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8F8649F4-1A33-41AE-888F-2D6BB19BCB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F6D11F61-8D0C-4545-9193-370D6D01ECB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4:beta2:*:*:*:*:*:*",
"matchCriteriaId": "60F2A706-CBF1-42F5-AC04-E68C1981CCB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2DC37F28-C58A-4492-A107-4348ECE9AAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "206B72EC-895E-4DA0-B41B-AAE41E53C108",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5:beta1:*:*:*:*:*:*",
"matchCriteriaId": "A46A8B81-2D8D-431A-832A-4517E9616B92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CC131029-CE9C-437E-B3D3-7924062E14D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF34A817-09AC-4C7E-916B-1B158C5EE599",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "20E8FFE1-9431-4146-AFD3-5491F5FE3C23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C1016173-D980-4909-86C0-81C94711FE27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "068BF668-9626-4CA4-A401-1946DCF916AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DA029BD9-1025-4802-BAE2-BEE218715FC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9928102A-27E2-4604-93F4-318BA7CDCAFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "F1EECFB4-7001-411F-BBAE-BABD5248E4B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "40C6F2FA-0518-4B2A-9F05-51897A16AF6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "A35145EB-E7A7-48EC-91A9-9D423F316712",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "589C199E-12F9-41CF-BFE0-4B952B773460",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "7BB9992D-2EF4-4DBF-898A-6284A074403E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B18A2D88-5B3E-4CCF-B979-F7D7A9F7EA1F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2F14D3BD-5835-4206-BE44-72F31F46D067",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add Field Definition, or (7) Add Shortcut module."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de comandos en sitios cruzados(XSS) en CMS Made Simple v1.7.1 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de la entrada de datos a los modulos (1) Agregar p\u00e1ginas (Add Pages), (2) A\u00f1adir contenido global (Add Global Content), (3) Editar Mundial Contenido(Edit Global Content), (4) A\u00f1adir art\u00edculo (Add Article), (5) A\u00f1adir una categor\u00eda (Add Category), (6) Agregar una definici\u00f3n de campo (Add Field Definition), o (7) Agregar acceso directo (Add Shortcut)."
}
],
"id": "CVE-2010-3882",
"lastModified": "2024-11-21T01:19:49.197",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-10-08T21:00:05.457",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40031"
},
{
"source": "cve@mitre.org",
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40031"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-02-21 07:59
Modified
2024-11-21 03:29
Severity ?
Summary
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/project/files/69 | Product | |
| cve@mitre.org | https://daylight-it.com/security-advisory-dlcs0001.html | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/project/files/69 | Product | |
| af854a3a-2127-422b-91ae-364da2661108 | https://daylight-it.com/security-advisory-dlcs0001.html | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | form_builder | * | |
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:form_builder:*:*:*:*:*:cms_made_simple:*:*",
"matchCriteriaId": "02E39951-3657-4625-BAD5-C5B1622FAC9D",
"versionEndIncluding": "0.8.1.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DBC86285-74C1-45C4-B9E6-C74B992D3DC2",
"versionEndIncluding": "1.12.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml."
},
{
"lang": "es",
"value": "CMS Made Simple versi\u00f3n 1.x Form Builder antes de la versi\u00f3n 0.8.1.6 permite a atacantes remotos llevar a cabo ataques de divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s de exportxml."
}
],
"id": "CVE-2017-6071",
"lastModified": "2024-11-21T03:29:02.187",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-02-21T07:59:00.420",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "http://dev.cmsmadesimple.org/project/files/69"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://daylight-it.com/security-advisory-dlcs0001.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-13 05:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses \"eval(\u0027function testfunction\u0027.rand()\" and it is possible to bypass certain restrictions on these \"testfunction\" functions."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7 contiene una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo arbitrario en el panel de administraci\u00f3n debido a que la implementaci\u00f3n emplea \"eval(\u0027function testfunction\u0027.rand()\" y es posible omitir ciertas restricciones en estas funciones \"testfunction\"."
}
],
"id": "CVE-2018-10086",
"lastModified": "2024-11-21T03:40:47.733",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-13T05:29:00.510",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-07-02 18:15
Modified
2024-11-21 05:29
Severity ?
Summary
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the {page_image} tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://dev.cmsmadesimple.org/bug/view/12325 | Exploit, Issue Tracking, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.14 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "1DE77B27-FF4F-4E3E-A05C-0AE09FD9372B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \"Path for the {page_image} tag:\" or \"Path for thumbnail field:\" parameters under the \"Content Editing Settings\" module."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versi\u00f3n 2.2.14, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de una carga \u00fatil dise\u00f1ada introducida en los par\u00e1metros \"Path for the {page_image} tag:\" o \"Path for thumbnail field:\" en el m\u00f3dulo \"Content Editing Settings\""
}
],
"id": "CVE-2020-36411",
"lastModified": "2024-11-21T05:29:26.793",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-07-02T18:15:08.820",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Vendor Advisory"
],
"url": "http://dev.cmsmadesimple.org/bug/view/12325"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-10-20 22:15
Modified
2024-11-21 08:24
Severity ?
Summary
Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/sromanhu/CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/sromanhu/CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "AEF989DA-0199-49AE-A793-1CE18C1E045A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component."
},
{
"lang": "es",
"value": "Una vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 permite a un atacante local ejecutar c\u00f3digo arbitrario a trav\u00e9s de un script manipulado en el par\u00e1metro Title en el componente Manage Shortcuts."
}
],
"id": "CVE-2023-43357",
"lastModified": "2024-11-21T08:24:03.007",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-10-20T22:15:10.807",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/sromanhu/CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-11-12 18:29
Modified
2024-11-21 03:16
Severity ?
Summary
In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or .svg.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md | Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md | Issue Tracking, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 2.2.3.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2A968051-0C53-434A-9EAF-9348D4B66C44",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a \"php\" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or .svg."
},
{
"lang": "es",
"value": "En CMS Made Simple 2.2.3.1, la funci\u00f3n is_file_acceptable en modules/FileManager/action.upload.php solo bloquea las extensiones de archivo que empiezan o finalizan con una subcadena \"php\", lo que permite a los atacantes remotos omitir las restricciones de acceso planeadas o desencadenar Cross-Site Scripting (XSS) mediante otras extensiones, tal y como se demostr\u00f3 con .phtml, .pht, .html o .svg."
}
],
"id": "CVE-2017-16798",
"lastModified": "2024-11-21T03:16:59.680",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-11-12T18:29:00.300",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://github.com/bsmali4/cve/blob/master/CMS%20Made%20Simple%20UPLOAD%20FILE%20XSS.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-13 05:29
Modified
2024-11-21 03:40
Severity ?
Summary
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cve/blob/master/README.md | Exploit, Technical Description, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\\FilePicker does not restrict the val parameter."
},
{
"lang": "es",
"value": "CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7 contiene una vulnerabilidad de borrado de archivos arbitrarios en el panel admin mediante secuencias de salto de directorio en el par\u00e1metro val con una petici\u00f3n cmd=del. Esto se debe a que el c\u00f3digo en modules\\FilePicker no restringe el par\u00e1metro val."
}
],
"id": "CVE-2018-10083",
"lastModified": "2024-11-21T03:40:47.307",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-13T05:29:00.323",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-04-27 18:29
Modified
2024-11-21 03:41
Severity ?
Summary
In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/itodaro/cmsms_cve/blob/master/README.md | Exploit, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ABE080D4-548B-4AF1-9E61-9381338CC90C",
"versionEndIncluding": "2.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In CMS Made Simple (CMSMS) through 2.2.7, the \"file unpack\" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive."
},
{
"lang": "es",
"value": "En CMS Made Simple (CMSMS) hasta la versi\u00f3n 2.2.7, la operaci\u00f3n \"file unpack\" en el dashboard de administrador contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo explotable por un usuario administrador debido a que puede haber un archivo .php en el archivo ZIP extra\u00eddo."
}
],
"id": "CVE-2018-10515",
"lastModified": "2024-11-21T03:41:28.613",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-04-27T18:29:00.290",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/itodaro/cmsms_cve/blob/master/README.md"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-12-31 05:00
Modified
2024-11-21 00:23
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the cntnt01searchinput parameter in a Search action.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cmsmadesimple | cms_made_simple | 1.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cmsmadesimple:cms_made_simple:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2946B5-8AAF-4386-8C31-7D291C31BB7E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in index.php in CMS Made Simple 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the cntnt01searchinput parameter in a Search action."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS)en index.php en CMS Made Simple 1.0.2 permite a un atacante remoto inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro cntnt01searchinput en una acci\u00f3n de b\u00fasqueda."
}
],
"id": "CVE-2006-6845",
"lastModified": "2024-11-21T00:23:47.113",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/32571"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23582"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/455417/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/21527"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0027"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/32571"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23582"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/455417/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/21527"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0027"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}