Login Request a demo
CM
Product
CMS Made Simple
by Cmsmadesimple · last CVE May 16, 2026
155
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities155In the news0Timeline
Severity mix
Critical 7High 35Medium 82Low 1
Severity
All severities155Critical7High35Medium82Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add CMS Made Simple to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2018-10085
9.8
4%
Apr 13
CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php
Affected: through 2.2.6
CVE-2018-10081
9.8
2%
Apr 13
CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e"…
Affected: through 2.2.7
CVE-2017-1000453
9.8
2%
Jan 2
CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution
Affected: before 2.2; 2.2.1 and later
CVE-2017-17735
9.8
1%
Dec 18
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies
Affected: before 2.2.5
CVE-2017-17734
9.8
1%
Dec 18
CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions
Affected: before 2.2.5
CVE-2017-16783
9.8
8%
Nov 10
In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter
Affected: 2.1.6
CVE-2017-6070
9.8
2%
Feb 21
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form
Affected: through 1.12.2
Showing 7