CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 中危6.1 |
Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4. |
| 17/12/2020 |
| CVE-2020-24860 | 中危5.4 | CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website. | 01/10/2020 |
| CVE-2020-22842 | 中危5.4 | CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php. | 30/09/2020 |
| CVE-2020-17462 | 高危7.8 | CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798. | 14/08/2020 |
| CVE-2020-14926 | 中危5.4 | CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page. | 19/06/2020 |
| CVE-2020-13660 | 中危4.8 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. | 28/05/2020 |
| CVE-2020-10682 | 高危7.8 | The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file). | 20/03/2020 |
| CVE-2020-10681 | 中危5.4 | The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php. | 20/03/2020 |
| CVE-2011-4310 | 高危7.5 | The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. | 26/11/2019 |
| CVE-2019-17630 | 中危4.8 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. | 16/10/2019 |
| CVE-2019-17629 | 中危4.8 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. | 16/10/2019 |
| CVE-2019-17226 | 中危4.8 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. | 06/10/2019 |
| CVE-2019-1010290 | 中危6.1 | Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" parameter. The component is: redirect.php. The attack vector is: The victim must open a link created by an attacker. Attacker may use any legitimate site using Babe | 16/07/2019 |
| CVE-2019-11226 | 中危5.4 | CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News. | 05/06/2019 |
| CVE-2019-11513 | 中危4.8 | The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. | 25/04/2019 |
| CVE-2019-9056 | 高危8.8 | An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection. | 11/04/2019 |
| CVE-2019-10107 | 中危5.4 | CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section. | 26/03/2019 |