CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 25/01/2018 |
| CVE-2018-5963 | MOYENNE4.8 | CMS Made Simple (CMSMS) 2.2.5 has XSS in admin/addbookmark.php via the title parameter. | 25/01/2018 |
| CVE-2017-1000454 | ÉLEVÉE7.8 | CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1 | 02/01/2018 |
| CVE-2017-1000453 | CRITIQUE9.8 | CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution. | 02/01/2018 |
| CVE-2017-17735 | CRITIQUE9.8 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies. | 18/12/2017 |
| CVE-2017-17734 | CRITIQUE9.8 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions. | 18/12/2017 |
| CVE-2017-16799 | MOYENNE5.4 | In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1_name parameter to admin/moduleinterface.php during addition of a category, a related issue to CVE-2010-3882. | 12/11/2017 |
| CVE-2017-16798 | MOYENNE5.4 | In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or | 12/11/2017 |
| CVE-2017-16784 | MOYENNE6.1 | In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter. | 10/11/2017 |
| CVE-2017-16783 | CRITIQUE9.8 | In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter. | 10/11/2017 |
| CVE-2017-11405 | MOYENNE4.9 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file. | 18/07/2017 |
| CVE-2017-11404 | MOYENNE4.9 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php. | 18/07/2017 |
| CVE-2017-9668 | MOYENNE6.1 | In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action. | 18/06/2017 |
| CVE-2017-8912 | ÉLEVÉE7.2 | CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug. | 12/05/2017 |
| CVE-2017-7257 | MOYENNE5.4 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack. | 24/03/2017 |
| CVE-2017-7256 | MOYENNE5.4 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack. | 24/03/2017 |
| CVE-2017-7255 | MOYENNE5.4 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack. | 24/03/2017 |