Filtered by vendor Cmsmadesimple Subscriptions
Filtered by product Cms Made Simple Subscriptions
Total 153 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-10082 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php.
CVE-2018-10081 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring.
CVE-2018-10033 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
CVE-2018-10032 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
CVE-2018-10031 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
CVE-2018-10030 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
CVE-2018-10029 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
CVE-2018-1000158 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack.
CVE-2018-1000094 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.
CVE-2018-1000092 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6.
CVE-2017-1000454 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1
CVE-2017-1000453 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
CVE-2011-4310 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 7.5 High
The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.