High severity · published Mar 12, 2024
CVE-2024-1527
Unrestricted Upload of File with Dangerous Type in CMS Made Simple
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
CMS Made Simple · CMS Made Simple
2.2.14 · source: vendor, NVD
CM
Cmsmadesimple · Cmsmadesimple
2.2.14 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1527
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1527
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cms-made-simple
More from CMS Made Simple
6.1
CVE-2024-1529
Cross-site Scripting in CMS Made Simple
6.1
CVE-2024-1528
Cross-site Scripting in CMS Made Simple
4.7
CVE-2026-5203
CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal
2.4
CVE-2026-4225
CMS Made Simple User Management listusers.php cross site scripting
–
CVE-2008-2267
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by…