Cmsmadesimple

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-36408 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Jul 2, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Ma...Show more A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module.Show less
CVE-2020-27377 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Jun 1, 2021 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
CVE-2021-28935 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 30, 2021 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
CVE-2020-20138 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Dec 17, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4.
CVE-2020-24860 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Oct 1, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user wh...Show more CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.Show less
CVE-2020-22842 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Sep 30, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.
CVE-2020-17462 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Aug 14, 2020 N/A· v4 7.8 HIGH· v3 6.5 MEDIUM· v2 CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.
CVE-2020-14926 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Jun 19, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page.
CVE-2020-13660 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 May 28, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
CVE-2020-10682 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 20, 2020 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and conta...Show more The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file).Show less
CVE-2020-10681 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 20, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
CVE-2011-4310 1Cmsmadesimple 1Cms Made Simple Nov 21, 2024 Nov 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
CVE-2019-17630 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Oct 16, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen.
CVE-2019-17629 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Oct 16, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen.
CVE-2019-17226 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Oct 6, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
CVE-2019-1010290 1Cmsmadesimple 1Bable\ Jun 17, 2026 Jul 16, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" parameter. The component is: redirect.php. The attack vector is:...Show more Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" parameter. The component is: redirect.php. The attack vector is: The victim must open a link created by an attacker. Attacker may use any legitimate site using Babel to redirect user to a URL of his/her choosing.Show less
CVE-2019-11226 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Jun 5, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.
CVE-2019-11513 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Apr 25, 2019 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action.
CVE-2019-9056 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Apr 11, 2019 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an unt...Show more An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection.Show less
CVE-2019-10107 1Cmsmadesimple 1Cms Made Simple Jun 17, 2026 Mar 26, 2019 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.

Previous 1 234 5...8 Next