Filtered by vendor Cmsmadesimple Subscriptions
Total 149 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-10030 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
CVE-2011-3718 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444.
CVE-2018-10083 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter.
CVE-2010-2797 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
CVE-2019-9693 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id).
CVE-2018-10522 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.
CVE-2010-4663 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors.
CVE-2018-10516 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory.
CVE-2018-10085 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files.
CVE-2018-18271 1 Cmsmadesimple 1 Cms Made Simple 2024-09-17 N/A
XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
CVE-2010-1482 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.
CVE-2018-10521 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.
CVE-2010-3883 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications.
CVE-2017-1000453 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
CVE-2018-10523 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignManager/action.ajax_get_stylesheets.php, /modules/FileManager/dunzip.php, or /modules/FileManager/untgz.php.
CVE-2017-11405 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file.
CVE-2018-10082 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php.
CVE-2018-10031 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
CVE-2013-4167 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2018-10519 1 Cmsmadesimple 1 Cms Made Simple 2024-09-16 N/A
CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084.