CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 02/01/2018 |
| CVE-2017-1000453 | 严重9.8 | CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution. | 02/01/2018 |
| CVE-2017-17735 | 严重9.8 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies. | 18/12/2017 |
| CVE-2017-17734 | 严重9.8 | CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions. | 18/12/2017 |
| CVE-2017-16798 | 中危5.4 | In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a "php" substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or | 12/11/2017 |
| CVE-2017-16784 | 中危6.1 | In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter. | 10/11/2017 |
| CVE-2017-16783 | 严重9.8 | In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter. | 10/11/2017 |
| CVE-2017-11405 | 中危4.9 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file. | 18/07/2017 |
| CVE-2017-11404 | 中危4.9 | In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php. | 18/07/2017 |
| CVE-2017-9668 | 中危6.1 | In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action. | 18/06/2017 |
| CVE-2017-8912 | 高危7.2 | CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug. | 12/05/2017 |
| CVE-2017-7257 | 中危5.4 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack. | 24/03/2017 |
| CVE-2017-7256 | 中危5.4 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack. | 24/03/2017 |
| CVE-2017-7255 | 中危5.4 | XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack. | 24/03/2017 |
| CVE-2017-6556 | 中危5.4 | Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage > sitesetting > General Settings > globalmetadata" field. | 09/03/2017 |
| CVE-2017-6555 | 中危5.4 | Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka "Design Manager > Categories > Category Description"). | 09/03/2017 |
| CVE-2017-6072 | 中危5.3 | CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via defaultadmin. | 21/02/2017 |