Product:

Cms_made_simple

(Cmsmadesimple)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 151
Date Id Summary Products Score Patch Annotated
2019-03-26 CVE-2019-9057 An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection. Cms_made_simple 8.8
2019-03-26 CVE-2019-9058 An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection. Cms_made_simple 7.2
2019-03-26 CVE-2019-9061 An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize call with untrusted input and achieve authenticated object injection by using the "install module" feature. Cms_made_simple 8.8
2021-09-17 CVE-2019-9060 An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1). Cms_made_simple 7.5
2017-11-10 CVE-2017-16783 In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter. Cms_made_simple 9.8
2018-04-13 CVE-2018-10085 CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files. Cms_made_simple 9.8
2017-02-21 CVE-2017-6071 CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml. Cms_made_simple, Form_builder N/A
2020-03-20 CVE-2020-10681 The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php. Cms_made_simple N/A
2020-03-20 CVE-2020-10682 The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file). Cms_made_simple N/A
2019-11-26 CVE-2011-4310 The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. Cms_made_simple N/A