Filtered by vendor Cmsmadesimple Subscriptions
Filtered by product Cms Made Simple Subscriptions
Total 147 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-11226 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
CVE-2019-10107 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.
CVE-2019-10106 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.
CVE-2019-10105 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager.
CVE-2019-10017 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker.
CVE-2019-9692 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).
CVE-2019-9061 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 8.8 High
An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature.
CVE-2019-9058 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 7.2 High
An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection.
CVE-2019-9053 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
CVE-2019-9056 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection.
CVE-2019-9060 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 7.5 High
An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1).
CVE-2019-9057 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 8.8 High
An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.
CVE-2019-9059 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-mail executable in Mail Settings, setting "sendmail" in the "Mailer" option, and launching the "Forgot your password" feature.
CVE-2019-9055 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 N/A
An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection.
CVE-2020-36412 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 5.4 Medium
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Search Text" field under the "Admin Search" module.
CVE-2020-36414 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 5.4 Medium
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "URL (slug)" or "Extra" fields under the "Add Article" feature.
CVE-2020-36416 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 5.4 Medium
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module.
CVE-2020-36413 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 5.4 Medium
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Exclude these IP addresses from the "Site Down" status" parameter under the "Maintenance Mode" module.
CVE-2020-36415 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 5.4 Medium
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Stylesheet" parameter under the "Stylesheets" module.
CVE-2020-36408 1 Cmsmadesimple 1 Cms Made Simple 2024-08-04 5.4 Medium
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module.