Filtered by vendor Cmsmadesimple
Subscriptions
Total
149 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2011-4310 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-07 | 7.5 High |
| The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. | ||||
| CVE-2012-6064 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-06 | N/A |
| Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files. | ||||
| CVE-2012-5450 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-06 | N/A |
| Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter. | ||||
| CVE-2012-1992 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-06 | N/A |
| Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template). | ||||
| CVE-2013-3929 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-06 | N/A |
| Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject arbitrary web script or HTML via the handler parameter. | ||||
| CVE-2014-2245 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-06 | N/A |
| SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information. | ||||
| CVE-2014-2092 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-06 | N/A |
| Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries. | ||||
| CVE-2014-0334 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-06 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092. | ||||
| CVE-2016-7904 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-06 | N/A |
| Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request. | ||||
| CVE-2016-2784 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | N/A |
| CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request. | ||||
| CVE-2017-16799 | 1 Cmsmadesimple | 1 Cmsmadesimple | 2024-08-05 | N/A |
| In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1_name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882. | ||||
| CVE-2017-16783 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | 9.8 Critical |
| In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter. | ||||
| CVE-2017-16798 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | 5.4 Medium |
| In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or .svg. | ||||
| CVE-2017-16784 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | N/A |
| In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter. | ||||
| CVE-2017-9668 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | N/A |
| In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action. | ||||
| CVE-2017-8912 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | 7.2 High |
| CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug. | ||||
| CVE-2017-7257 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | N/A |
| XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack. | ||||
| CVE-2017-7256 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | N/A |
| XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack. | ||||
| CVE-2017-7255 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | N/A |
| XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack. | ||||
| CVE-2017-6556 | 1 Cmsmadesimple | 1 Cms Made Simple | 2024-08-05 | N/A |
| Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage > sitesetting > General Settings > globalmetadata" field. | ||||