Cmsmadesimple Cms Made Simple vulnerabilities

CVE-2023-36969 [HIGH] CWE-434 CVE-2023-36969: CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function. CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.

CVE-2019-9053 [HIGH] CWE-89 CVE-2019-9053: An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a cra An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.

CVE-2018-1000094 [HIGH] CWE-434 CVE-2018-1000094: CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that ca CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.

CVE-2017-16783 [CRITICAL] CWE-94 CVE-2017-16783: In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate para In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.

CVE-2019-9055 [HIGH] CWE-502 CVE-2019-9055: An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.a An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection.

CVE-2019-9692 [MEDIUM] CWE-434 CVE-2019-9692: class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).

CVE-2018-7448 [HIGH] CWE-78 CVE-2018-7448: Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure.

CVE-2018-10517 [HIGH] CWE-94 CVE-2018-10517: In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard conta In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.

CVE-2017-8912 [HIGH] CWE-94 CVE-2017-8912: CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP co CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug.

CVE-2007-2473 [HIGH] CVE-2007-2473: SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote att SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.

CVE-2005-2846 [HIGH] CVE-2005-2846: PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remot PHP remote file inclusion vulnerability in lang.php in CMS Made Simple 0.10 and earlier allows remote attackers to execute arbitrary PHP code via the nls[file][vx][vxsfx] parameter.

CVE-2007-6656 [HIGH] CWE-89 CVE-2007-6656: SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and e SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter.

CVE-2008-5642 [MEDIUM] CWE-22 CVE-2008-5642: Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attacker Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie.

CVE-2018-10085 [CRITICAL] CWE-502 CVE-2018-10085: CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOperations.php. By sending a crafted cookie, a remote attacker can upload and execute code, or delete files.

CVE-2017-1000453 [CRITICAL] CWE-74 CVE-2017-1000453: CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core mod CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.

CVE-2021-40961 [HIGH] CWE-89 CVE-2021-40961: CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.

CVE-2021-28999 [HIGH] CWE-89 CVE-2021-28999: SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arb SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php.

CVE-2024-1527 [HIGH] CWE-434 CVE-2024-1527: Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerabil Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell.

CVE-2024-27622 [HIGH] CWE-75 CVE-2024-27622: A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Mad A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result, authenticated users with administrative privileges can inject and execute arbitrary PHP code

CVE-2017-6070 [CRITICAL] CWE-200 CVE-2017-6070: CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute P CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.