CVEs (154)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Dec 17, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4. |
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user wh...Show more |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Sep 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Aug 14, 2020 N/A· v4 7.8 HIGH· v3 6.5 MEDIUM· v2 CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Jun 19, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 May 28, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 20, 2020 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and conta...Show more |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 20, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php. |
1Cmsmadesimple 1Cms Made Simple Nov 21, 2024 Nov 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Oct 16, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Oct 16, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. |
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. |
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Apr 25, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Apr 11, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an unt...Show more |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 26, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 26, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section. |
1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 26, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager. |