CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 01/10/2020 |
| CVE-2020-22842 | 中危5.4 | CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php. | 30/09/2020 |
| CVE-2020-17462 | 高危7.8 | CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798. | 14/08/2020 |
| CVE-2020-14926 | 中危5.4 | CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page. | 19/06/2020 |
| CVE-2020-13660 | 中危4.8 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. | 28/05/2020 |
| CVE-2020-10682 | 高危7.8 | The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file). | 20/03/2020 |
| CVE-2020-10681 | 中危5.4 | The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php. | 20/03/2020 |
| CVE-2011-4310 | 高危7.5 | The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. | 26/11/2019 |
| CVE-2019-17630 | 中危4.8 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. | 16/10/2019 |
| CVE-2019-17629 | 中危4.8 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. | 16/10/2019 |
| CVE-2019-17226 | 中危4.8 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. | 06/10/2019 |
| CVE-2019-11226 | 中危5.4 | CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News. | 05/06/2019 |
| CVE-2019-11513 | 中危4.8 | The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. | 25/04/2019 |
| CVE-2019-9056 | 高危8.8 | An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection. | 11/04/2019 |
| CVE-2019-10107 | 中危5.4 | CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section. | 26/03/2019 |
| CVE-2019-10106 | 中危5.4 | CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section. | 26/03/2019 |
| CVE-2019-10105 | 中危5.4 | CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager. | 26/03/2019 |