Product:

Cms_made_simple

(Cmsmadesimple)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 151
Date Id Summary Products Score Patch Annotated
2025-05-25 CVE-2025-5153 A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Design Manager Module. The manipulation of the argument Description leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Cms_made_simple 4.8
2024-03-12 CVE-2024-1527 Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell. Cms_made_simple 8.8
2024-03-12 CVE-2024-1528 CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/moduleinterface.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session. Cms_made_simple 6.1
2024-03-12 CVE-2024-1529 Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/adduser.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to an authenticated user and partially take over their browser session. Cms_made_simple 6.1
2023-05-08 CVE-2021-28998 File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file. Cms_made_simple 7.2
2023-05-08 CVE-2021-28999 SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php. Cms_made_simple 8.8
2020-05-28 CVE-2020-13660 CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. Cms_made_simple 4.8
2020-06-19 CVE-2020-14926 CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page. Cms_made_simple 5.4
2020-08-14 CVE-2020-17462 CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798. Cms_made_simple 7.8
2020-09-30 CVE-2020-22842 CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php. Cms_made_simple 5.4