CM
Product
CMS Made Simple
155
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 35Medium 82Low 1
Watch
Add CMS Made Simple to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-43154 | 6.1 | Apr 13 | Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php Affected: 2.2.15 |
| CVE-2022-23907 | 6.1 | Feb 28 | CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage Affected: 2.2.15 |
| CVE-2020-20138 | 6.1 | Dec 17 | Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4 Affected: 2.2.4 |
| CVE-2018-20464 | 6.1 | Dec 25 | There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php Affected: 2.2.8 |
| CVE-2018-18271 | 6.1 | Oct 12 | XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action Affected: 2.2.7 |
| CVE-2018-18270 | 6.1 | Oct 12 | XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action Affected: 2.2.7 |
| CVE-2017-16784 | 6.1 | Nov 10 | In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter Affected: 2.2.2 |
| CVE-2017-9668 | 6.1 | Jun 18 | In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an… Affected: 2.1.6 |
| CVE-2024-27623 | 5.9 | Mar 5 | CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI) Affected: 2.2.19 |
| CVE-2023-43360 | 5.4 | Oct 24 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File… Affected: 2.2.18 |
| CVE-2023-43358 | 5.4 | Oct 23 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu… Affected: 2.2.18 |
| CVE-2023-43357 | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts… Affected: 2.2.18 |
| CVE-2023-43353 | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu… Affected: 2.2.18 |
| CVE-2023-43354 | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions… Affected: 2.2.18 |
| CVE-2023-43355 | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters… Affected: 2.2.18 |
| CVE-2023-43356 | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global… Affected: 2.2.18 |
| CVE-2023-43359 | 5.4 | Oct 19 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data… Affected: 2.2.18 |
| CVE-2023-43872 | 5.4 | Sep 28 | A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS) Affected: 2.2.18 |
| CVE-2023-36970 | 5.4 | Jul 6 | A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function Affected: 2.2.17 |
| CVE-2020-23481 | 5.4 | Sep 22 | CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload… Affected: 2.2.14 |
| CVE-2020-36416 | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… Affected: 2.2.14 |
| CVE-2020-36415 | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… Affected: 2.2.14 |
| CVE-2020-36414 | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… Affected: 2.2.14 |
| CVE-2020-36413 | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… Affected: 2.2.14 |
| CVE-2020-36412 | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… Affected: 2.2.14 |
| CVE-2020-36411 | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… Affected: 2.2.14 |
| CVE-2020-36410 | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… Affected: 2.2.14 |
| CVE-2020-36409 | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… Affected: 2.2.14 |
| CVE-2020-36408 | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… Affected: 2.2.14 |
| CVE-2021-28935 | 5.4 | Mar 30 | CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field Affected: 2.2.15 |
| CVE-2020-24860 | 5.4 | Oct 1 | CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields Affected: 2.2.14 |
| CVE-2020-22842 | 5.4 | Sep 30 | CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php Affected: before 2.2.15 |
| CVE-2020-14926 | 5.4 | Jun 19 | CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page Affected: 2.2.14 |
| CVE-2020-10681 | 5.4 | Mar 20 | The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php Affected: 2.2.13 |
| CVE-2019-11226 | 5.4 | Jun 5 | CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News Affected: 2.2.10 |
| CVE-2019-10107 | 5.4 | Mar 26 | CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section Affected: 2.2.10 |
| CVE-2019-10106 | 5.4 | Mar 26 | CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section Affected: 2.2.10 |
| CVE-2019-10105 | 5.4 | Mar 26 | CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager Affected: 2.2.10 |
| CVE-2019-10017 | 5.4 | Mar 24 | CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker Affected: 2.2.10 |
| CVE-2017-16798 | 5.4 | Nov 12 | In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which… Affected: 2.2.3.1 |
| CVE-2017-7257 | 5.4 | Mar 24 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter Affected: 2.1.6 |
| CVE-2017-7256 | 5.4 | Mar 24 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter Affected: 2.1.6 |
| CVE-2017-7255 | 5.4 | Mar 24 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter Affected: 2.1.6 |
| CVE-2017-6556 | 5.4 | Mar 9 | Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage > sitesetting… Affected: 2.1.6 |
| CVE-2017-6555 | 5.4 | Mar 9 | Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the… Affected: 2.1.6 |
| CVE-2018-10523 | 5.3 | Apr 27 | CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php,… Affected: through 2.2.7 |
| CVE-2018-9921 | 5.3 | Apr 23 | In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and… Affected: 2.2.7 |
| CVE-2018-10082 | 5.3 | Apr 13 | CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request… Affected: through 2.2.7 |
| CVE-2017-6072 | 5.3 | Feb 21 | CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin Affected: through 1.12.2 |
| CVE-2017-6071 | 5.3 | Feb 21 | CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml Affected: through 1.12.2 |