CM
Product
CMS Made Simple
155
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 35Medium 82Low 1
Watch
Add CMS Made Simple to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7255 | 5.4 | Mar 24 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter Affected: 2.1.6 |
| CVE-2017-6556 | 5.4 | Mar 9 | Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage > sitesetting… Affected: 2.1.6 |
| CVE-2017-6555 | 5.4 | Mar 9 | Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the… Affected: 2.1.6 |
| CVE-2018-10523 | 5.3 | Apr 27 | CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php,… Affected: through 2.2.7 |
| CVE-2018-9921 | 5.3 | Apr 23 | In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and… Affected: 2.2.7 |
| CVE-2018-10082 | 5.3 | Apr 13 | CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request… Affected: through 2.2.7 |
| CVE-2017-6072 | 5.3 | Feb 21 | CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin Affected: through 1.12.2 |
| CVE-2017-6071 | 5.3 | Feb 21 | CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml Affected: through 1.12.2 |
| CVE-2018-10522 | 4.9 | Apr 27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary… Affected: through 2.2.7 |
| CVE-2017-11405 | 4.9 | Jul 18 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker… Affected: 2.2.2 |
| CVE-2017-11404 | 4.9 | Jul 18 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php Affected: 2.2.2 |
| CVE-2025-5153 | 4.8 | May 25 | CMS Made Simple Design Manager Module cross site scripting Affected: 2.2.21 |
| CVE-2024-27625 | 4.8 | Mar 5 | CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS) Affected: 2.2.19 |
| CVE-2020-22732 | 4.8 | Aug 5 | CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker Affected: 2.2.14 |
| CVE-2020-23241 | 4.8 | Jul 26 | Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature Affected: 2.2.14 |
| CVE-2020-23240 | 4.8 | Jul 26 | Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature Affected: 2.2.14 |
| CVE-2020-27377 | 4.8 | Jun 1 | A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute… Affected: 2.2.14 |
| CVE-2020-13660 | 4.8 | May 28 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name Affected: through 2.2.14 |
| CVE-2019-17630 | 4.8 | Oct 16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen Affected: 2.2.11 |
| CVE-2019-17629 | 4.8 | Oct 16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen Affected: 2.2.11 |
| CVE-2019-17226 | 4.8 | Oct 6 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field Affected: 2.2.11 |
| CVE-2019-11513 | 4.8 | Apr 25 | The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action Affected: through 2.2.10 |
| CVE-2018-19597 | 4.8 | Dec 19 | CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798 Affected: 2.2.8 |
| CVE-2018-10033 | 4.8 | Apr 11 | CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter Affected: through 2.2.7 |
| CVE-2018-10032 | 4.8 | Apr 11 | CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter Affected: through 2.2.7 |
| CVE-2018-10029 | 4.8 | Apr 11 | CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799 Affected: through 2.2.7 |
| CVE-2018-8058 | 4.8 | Mar 12 | CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter Affected: 2.2.6 |
| CVE-2018-7893 | 4.8 | Mar 12 | CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter Affected: 2.2.6 |
| CVE-2018-5965 | 4.8 | Jan 25 | CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter Affected: 2.2.5 |
| CVE-2018-5964 | 4.8 | Jan 25 | CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter Affected: 2.2.5 |
| CVE-2018-5963 | 4.8 | Jan 25 | CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter Affected: 2.2.5 |
| CVE-2016-2784 | 4.7 | May 26 | CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +34 more |