Filtered by vendor Cmsimple Subscriptions
Total 11 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2008-2650 1 Cmsimple 1 Cmsimple 2024-08-07 N/A
Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number.
CVE-2014-2219 1 Cmsimple 1 Cmsimple Classic 2024-08-06 N/A
Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter.
CVE-2018-19507 1 Cmsimple 1 Cmsimple 2024-08-05 N/A
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.
CVE-2018-19508 1 Cmsimple 1 Cmsimple 2024-08-05 N/A
CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI.
CVE-2021-43741 1 Cmsimple 1 Cmsimple 2024-08-04 9.8 Critical
CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution.
CVE-2021-43742 1 Cmsimple 1 Cmsimple 2024-08-04 5.4 Medium
CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature.
CVE-2024-33423 1 Cmsimple 1 Cmsimple 2024-08-02 7.4 High
Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section.
CVE-2024-33424 1 Cmsimple 1 Cmsimple 2024-08-02 6.1 Medium
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section.
CVE-2024-32392 1 Cmsimple 1 Cmsimple 2024-08-02 4.5 Medium
Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component.
CVE-2024-32345 1 Cmsimple 1 Cmsimple 2024-08-02 0 Low
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Configuration parameter under the Language section.
CVE-2024-32344 1 Cmsimple 1 Cmsimple 2024-08-02 6.8 Medium
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit parameter under the Language section.