CVE-2019-9692

MEDIUM 6.5CVE-2019-9692 · Published 11/03/2019 · updated 17/06/2026

In short

CVE-2019-9692 is a MEDIUM (CVSS 6.5) vulnerability affecting cms made simple (cmsmadesimple).
Chance of exploitation in the next 30 days (EPSS): 45.9%, higher than 98.8% of all vulnerabilities.
Fix: update to 2.2.10 or later.

Package	Affected versions	Patched versions
cms made simple cmsmadesimple	`< 2.2.10`	`2.2.10`

Description

class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).

References

packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html · Exploit
viewsvn.cmsmadesimple.org/diff.php · Patch
rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce · Third Party Advisory
forum.cmsmadesimple.org/viewtopic.php · Vendor Advisory
exploit-db.com/exploits/46546 · Exploit
exploit-db.com/exploits/46627 · Exploit

More vulnerabilities in cms made simple

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

cms made simple

cmsmadesimple

< 2.2.10

2.2.10

More vulnerabilities in cms made simple

See all →