CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 01/10/2020 |
| CVE-2020-22842 | 보통5.4 | CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php. | 30/09/2020 |
| CVE-2020-17462 | 높음7.8 | CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798. | 14/08/2020 |
| CVE-2020-14926 | 보통5.4 | CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page. | 19/06/2020 |
| CVE-2020-13660 | 보통4.8 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. | 28/05/2020 |
| CVE-2020-10682 | 높음7.8 | The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file). | 20/03/2020 |
| CVE-2020-10681 | 보통5.4 | The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php. | 20/03/2020 |
| CVE-2011-4310 | 높음7.5 | The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. | 26/11/2019 |
| CVE-2019-17630 | 보통4.8 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. | 16/10/2019 |
| CVE-2019-17629 | 보통4.8 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. | 16/10/2019 |
| CVE-2019-17226 | 보통4.8 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. | 06/10/2019 |
| CVE-2019-11226 | 보통5.4 | CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News. | 05/06/2019 |
| CVE-2019-11513 | 보통4.8 | The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. | 25/04/2019 |
| CVE-2019-9056 | 높음8.8 | An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection. | 11/04/2019 |
| CVE-2019-10107 | 보통5.4 | CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section. | 26/03/2019 |
| CVE-2019-10106 | 보통5.4 | CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section. | 26/03/2019 |
| CVE-2019-10105 | 보통5.4 | CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager. | 26/03/2019 |