CM
Vendor
Cmsmadesimple
162
CVEs
0
On KEV
0
New 30D
Products
CM9.8
CMS Made Simple
Cmsmadesimple
155 CVEs0 on KEV0 new
FB9.8
Form Builder
Cmsmadesimple
3 CVEs0 on KEV0 new
CM8.8
Cmsmadesimple
Cmsmadesimple
2 CVEs0 on KEV0 new
BS6.1
Bable:multilingual Site
Cmsmadesimple
1 CVEs0 on KEV0 new
FM7.2
File Manager
Cmsmadesimple
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2020-37238 | CM CMS Made Simple Cmsmadesimple | 6.4 | May 16 | CMS Made Simple 2.2.15 Stored XSS via SVG File Upload |
| CVE-2025-63678 | FM File Manager Cmsmadesimple | 7.2 | Nov 10 | An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to… |
| CVE-2025-5153 | CM Cms Made Simple Cmsmadesimple | 4.8 | May 25 | CMS Made Simple Design Manager Module cross site scripting |
| CVE-2024-1529 | CM Cms Made Simple Cmsmadesimple | 6.1 | Mar 12 | Cross-site Scripting in CMS Made Simple |
| CVE-2024-1528 | CM Cms Made Simple Cmsmadesimple | 6.1 | Mar 12 | Cross-site Scripting in CMS Made Simple |
| CVE-2024-1527 | CM Cms Made Simple Cmsmadesimple | 8.8 | Mar 12 | Unrestricted Upload of File with Dangerous Type in CMS Made Simple |
| CVE-2024-27623 | CM Cms Made Simple Cmsmadesimple | 5.9 | Mar 5 | CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI) |
| CVE-2024-27622 | CM Cms Made Simple Cmsmadesimple | 7.2 | Mar 5 | A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21 |
| CVE-2024-27625 | CM Cms Made Simple Cmsmadesimple | 4.8 | Mar 5 | CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-43352 | CM Cms Made Simple Cmsmadesimple | 7.8 | Oct 26 | An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component |
| CVE-2023-43360 | CM Cms Made Simple Cmsmadesimple | 5.4 | Oct 24 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File… |
| CVE-2023-43358 | CM Cms Made Simple Cmsmadesimple | 5.4 | Oct 23 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu… |
| CVE-2023-43356 | CM Cms Made Simple Cmsmadesimple | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global… |
| CVE-2023-43354 | CM Cms Made Simple Cmsmadesimple | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions… |
| CVE-2023-43353 | CM Cms Made Simple Cmsmadesimple | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu… |
| CVE-2023-43357 | CM Cms Made Simple Cmsmadesimple | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts… |
| CVE-2023-43355 | CM Cms Made Simple Cmsmadesimple | 5.4 | Oct 20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters… |
| CVE-2023-43359 | CM Cms Made Simple Cmsmadesimple | 5.4 | Oct 19 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data… |
| CVE-2023-43872 | CM Cms Made Simple Cmsmadesimple | 5.4 | Sep 28 | A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS) |
| CVE-2023-43339 | CM Cms Made Simple Cmsmadesimple | 6.1 | Sep 25 | Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name,… |
| CVE-2023-36969 | CM Cms Made Simple Cmsmadesimple | 8.8 | Jul 6 | CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function |
| CVE-2023-36970 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 6 | A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function |
| CVE-2021-28999 | CM Cms Made Simple Cmsmadesimple | 8.8 | May 8 | SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to… |
| CVE-2021-28998 | CM Cms Made Simple Cmsmadesimple | 7.2 | May 8 | File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file |
| CVE-2021-40961 | CM Cms Made Simple Cmsmadesimple | 8.8 | Jun 9 | CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php |
| CVE-2021-43154 | CM Cms Made Simple Cmsmadesimple | 6.1 | Apr 13 | Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php |
| CVE-2022-23907 | CM Cms Made Simple Cmsmadesimple | 6.1 | Feb 28 | CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage |
| CVE-2022-23906 | CM Cms Made Simple Cmsmadesimple | 7.2 | Feb 28 | CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function |
| CVE-2020-23481 | CM Cms Made Simple Cmsmadesimple | 5.4 | Sep 22 | CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
| CVE-2019-9060 | CM Cms Made Simple Cmsmadesimple | 7.5 | Sep 17 | An issue was discovered in CMS Made Simple 2.2.8 |
| CVE-2020-22732 | CM Cms Made Simple Cmsmadesimple | 4.8 | Aug 5 | CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker |
| CVE-2020-23241 | CM Cms Made Simple Cmsmadesimple | 4.8 | Jul 26 | Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature |
| CVE-2020-23240 | CM Cms Made Simple Cmsmadesimple | 4.8 | Jul 26 | Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature |
| CVE-2020-36416 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
| CVE-2020-36415 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
| CVE-2020-36414 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
| CVE-2020-36413 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
| CVE-2020-36412 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
| CVE-2020-36411 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
| CVE-2020-36410 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
| CVE-2020-36409 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
| CVE-2020-36408 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jul 2 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
| CVE-2020-27377 | CM Cms Made Simple Cmsmadesimple | 4.8 | Jun 1 | A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute… |
| CVE-2021-28935 | CM Cms Made Simple Cmsmadesimple | 5.4 | Mar 30 | CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field |
| CVE-2020-20138 | CM Cms Made Simple Cmsmadesimple | 6.1 | Dec 17 | Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4 |
| CVE-2020-24860 | CM Cms Made Simple Cmsmadesimple | 5.4 | Oct 1 | CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields |
| CVE-2020-22842 | CM Cms Made Simple Cmsmadesimple | 5.4 | Sep 30 | CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php |
| CVE-2020-17462 | CM Cms Made Simple Cmsmadesimple | 7.8 | Aug 14 | CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798 |
| CVE-2020-14926 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jun 19 | CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page |
| CVE-2020-13660 | CM Cms Made Simple Cmsmadesimple | 4.8 | May 28 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name |
| CVE-2020-10682 | CM Cms Made Simple Cmsmadesimple | 7.8 | Mar 20 | The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php |
| CVE-2020-10681 | CM Cms Made Simple Cmsmadesimple | 5.4 | Mar 20 | The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php |
| CVE-2011-4310 | CM Cms Made Simple Cmsmadesimple | 7.5 | Nov 26 | The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles |
| CVE-2019-17630 | CM Cms Made Simple Cmsmadesimple | 4.8 | Oct 16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen |
| CVE-2019-17629 | CM Cms Made Simple Cmsmadesimple | 4.8 | Oct 16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen |
| CVE-2019-17226 | CM Cms Made Simple Cmsmadesimple | 4.8 | Oct 6 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field |
| CVE-2019-1010290 | BS Bable:multilingual Site Cmsmadesimple | 6.1 | Jul 16 | Babel: Multilingual site Babel All is affected by: Open Redirection |
| CVE-2019-11226 | CM Cms Made Simple Cmsmadesimple | 5.4 | Jun 5 | CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News |
| CVE-2019-11513 | CM Cms Made Simple Cmsmadesimple | 4.8 | Apr 25 | The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action |
| CVE-2019-9056 | CM Cms Made Simple Cmsmadesimple | 8.8 | Apr 11 | An issue was discovered in CMS Made Simple 2.2.8 |