CM
Product
CMS Made Simple
155
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 35Medium 82Low 1
Watch
Add CMS Made Simple to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-10522 | 4.9 | Apr 27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary… Affected: through 2.2.7 |
| CVE-2017-11405 | 4.9 | Jul 18 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker… Affected: 2.2.2 |
| CVE-2017-11404 | 4.9 | Jul 18 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php Affected: 2.2.2 |
| CVE-2025-5153 | 4.8 | May 25 | CMS Made Simple Design Manager Module cross site scripting Affected: 2.2.21 |
| CVE-2024-27625 | 4.8 | Mar 5 | CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS) Affected: 2.2.19 |
| CVE-2020-22732 | 4.8 | Aug 5 | CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker Affected: 2.2.14 |
| CVE-2020-23241 | 4.8 | Jul 26 | Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature Affected: 2.2.14 |
| CVE-2020-23240 | 4.8 | Jul 26 | Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature Affected: 2.2.14 |
| CVE-2020-27377 | 4.8 | Jun 1 | A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute… Affected: 2.2.14 |
| CVE-2020-13660 | 4.8 | May 28 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name Affected: through 2.2.14 |
| CVE-2019-17630 | 4.8 | Oct 16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen Affected: 2.2.11 |
| CVE-2019-17629 | 4.8 | Oct 16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen Affected: 2.2.11 |
| CVE-2019-17226 | 4.8 | Oct 6 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field Affected: 2.2.11 |
| CVE-2019-11513 | 4.8 | Apr 25 | The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action Affected: through 2.2.10 |
| CVE-2018-19597 | 4.8 | Dec 19 | CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798 Affected: 2.2.8 |
| CVE-2018-10033 | 4.8 | Apr 11 | CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter Affected: through 2.2.7 |
| CVE-2018-10032 | 4.8 | Apr 11 | CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter Affected: through 2.2.7 |
| CVE-2018-10029 | 4.8 | Apr 11 | CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799 Affected: through 2.2.7 |
| CVE-2018-8058 | 4.8 | Mar 12 | CMS Made Simple (CMSMS) 2.2.6 has XSS in admin/moduleinterface.php via the pagedata parameter Affected: 2.2.6 |
| CVE-2018-7893 | 4.8 | Mar 12 | CMS Made Simple (CMSMS) 2.2.6 has stored XSS in admin/moduleinterface.php via the metadata parameter Affected: 2.2.6 |
| CVE-2018-5965 | 4.8 | Jan 25 | CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_errors parameter Affected: 2.2.5 |
| CVE-2018-5964 | 4.8 | Jan 25 | CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/moduleinterface.php via the m1_messages parameter Affected: 2.2.5 |
| CVE-2018-5963 | 4.8 | Jan 25 | CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter Affected: 2.2.5 |
| CVE-2016-2784 | 4.7 | May 26 | CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.0.4; 1.0.5; +34 more |
| CVE-2018-10521 | 2.7 | Apr 27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an… Affected: through 2.2.7 |
| CVE-2014-2245 | – | Mar 5 | SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary… Affected: through 1.11.9; 0.1; 0.2; 0.2.1; 0.3; 0.3.1; +34 more |
| CVE-2014-2092 | – | Mar 2 | Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML… Affected: 1.11.10 |
| CVE-2014-0334 | – | Mar 2 | Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to… Affected: All versions, or not specified |
| CVE-2013-3929 | – | Dec 9 | Cross-site scripting (XSS) vulnerability in admin/editevent.php in CMS Made Simple (CMSMS) 1.11.9 allows remote authenticated users with the "Modify Events" permission to inject… Affected: 1.11.9 |
| CVE-2013-4167 | – | Oct 11 | Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 1.11.6; 1.11; 1.11.1; 1.11.2; 1.11.2.1; 1.11.3; +2 more |
| CVE-2012-6064 | – | Dec 3 | Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete… Affected: through 1.11.2; 0.1; 0.2; 0.2.1; 0.3; 0.3.1; +34 more |
| CVE-2012-5450 | – | Dec 3 | Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the… Affected: through 1.11.2; 0.1; 0.2; 0.2.1; 0.3; 0.3.1; +34 more |
| CVE-2012-1992 | – | Apr 11 | Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email… Affected: through 1.10.3; 0.1; 0.2; 0.2.1; 0.3; 0.3.1; +34 more |
| CVE-2011-3718 | – | Sep 23 | CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message,… Affected: 1.9.2 |
| CVE-2010-4663 | – | Jun 8 | Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors Affected: through 1.9; 0.1; 0.2; 0.2.1; 0.3; 0.3.1; +34 more |
| CVE-2010-3884 | – | Oct 8 | Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset… Affected: through 1.8.1 |
| CVE-2010-3883 | – | Oct 8 | Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of… Affected: through 1.7.1; 0.10; 0.10.3; 0.10.4; 0.11; 0.11; +34 more |
| CVE-2010-3882 | – | Oct 8 | Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add… Affected: through 1.7.1; 0.10; 0.10.3; 0.10.4; 0.11; 0.11; +34 more |
| CVE-2010-2797 | – | Oct 8 | Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a Affected: through 1.6.8; 1.0; 1.0; 1.0; 1.0; 1.0; +34 more |
| CVE-2010-1482 | – | May 12 | Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script… Affected: through 1.7; 0.10; 0.10.3; 0.10.4; 0.11; 0.11; +34 more |
| CVE-2008-5642 | – | Dec 17 | Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a Affected: 1.4.1 |
| CVE-2007-6656 | – | Jan 4 | SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the… Affected: through 1.2.2 |
| CVE-2007-5443 | – | Oct 14 | Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1)… Affected: 1.1.3.1 |
| CVE-2007-5444 | – | Oct 14 | CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files Affected: 1.1.3.1 |
| CVE-2007-5442 | – | Oct 14 | CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown… Affected: 1.1.3.1 |
| CVE-2007-5441 | – | Oct 14 | CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as… Affected: 1.1.3.1 |
| CVE-2007-5056 | – | Sep 24 | Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and… Affected: All versions, or not specified |
| CVE-2007-2473 | – | May 2 | SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter Affected: through 1.0.5 |
| CVE-2007-0610 | – | Jan 31 | Cross-site scripting (XSS) vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter Affected: 2.7 |
| CVE-2007-0551 | – | Jan 29 | Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the (1) pth[file][config]… Affected: 2.7 |