Cmsmadesimple Cms Made Simple vulnerabilities

CVE-2020-36415 [MEDIUM] CWE-79 CVE-2020-36415: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attacker A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Stylesheet" parameter under the "Stylesheets" module.

CVE-2020-36414 [MEDIUM] CWE-79 CVE-2020-36414: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attacker A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "URL (slug)" or "Extra" fields under the "Add Article" feature.

CVE-2018-18270 [MEDIUM] CWE-79 CVE-2018-18270: XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterfac XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.

CVE-2018-18271 [MEDIUM] CWE-79 CVE-2018-18271: XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.p XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.

CVE-2022-23907 [MEDIUM] CWE-79 CVE-2022-23907: CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerabili CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage.

CVE-2017-9668 [MEDIUM] CWE-79 CVE-2017-9668: In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action.

CVE-2019-10106 [MEDIUM] CWE-79 CVE-2019-10106: CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an " CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section.

CVE-2019-10107 [MEDIUM] CWE-79 CVE-2019-10107: CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via t CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section.

CVE-2020-14926 [MEDIUM] CWE-79 CVE-2020-14926: CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleMana CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page.

CVE-2017-7257 [MEDIUM] CWE-79 CVE-2017-7257: XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_co XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack.

CVE-2017-7255 [MEDIUM] CWE-79 CVE-2017-7255: XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_ti XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack.

CVE-2017-7256 [MEDIUM] CWE-79 CVE-2017-7256: XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_su XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack.

CVE-2020-36412 [MEDIUM] CWE-79 CVE-2020-36412: A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attacker A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Search Text" field under the "Admin Search" module.

CVE-2012-6064 [LOW] CVE-2012-6064: Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMS Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.

CVE-2018-20464 [MEDIUM] CWE-79 CVE-2018-20464: There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulner There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address.

CVE-2017-16784 [MEDIUM] CWE-79 CVE-2017-16784: In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter. In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter.

CVE-2017-6555 [MEDIUM] CWE-79 CVE-2017-6555: Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allo Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka "Design Manager > Categories > Category Description").

CVE-2017-6556 [MEDIUM] CWE-79 CVE-2017-6556: Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticate Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage > sitesetting > General Settings > globalmetadata" field.

CVE-2020-23481 [MEDIUM] CWE-79 CVE-2020-23481: CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which al CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field.

CVE-2018-10522 [MEDIUM] CWE-200 CVE-2018-10522: In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.