Filtered by vendor Cmsmadesimple Subscriptions
Total 149 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-10682 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 7.8 High
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file).
CVE-2020-10681 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 5.4 Medium
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
CVE-2019-9693 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id).
CVE-2019-9692 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).
CVE-2019-9061 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 8.8 High
An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.
CVE-2019-9060 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 7.5 High
An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1).
CVE-2019-9059 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature.
CVE-2019-9058 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 7.2 High
An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
CVE-2019-9057 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 8.8 High
An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.
CVE-2019-9056 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection.
CVE-2019-9055 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection.
CVE-2019-9053 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
CVE-2019-17630 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 4.8 Medium
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
CVE-2019-17629 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 4.8 Medium
CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
CVE-2019-17226 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 4.8 Medium
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
CVE-2019-11513 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
CVE-2019-11226 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
CVE-2019-10107 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.
CVE-2019-10106 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.
CVE-2019-10105 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager.