Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (157 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-10033 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.
CVE-2018-10032 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.
CVE-2018-10031 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php.
CVE-2018-10030 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php.
CVE-2018-10029 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.
CVE-2018-1000158 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack.
CVE-2018-1000094 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.
CVE-2018-1000092 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6.
CVE-2017-1000454 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1
CVE-2017-1000453 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 N/A
CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
CVE-2010-1482 1 Cmsmadesimple 1 Cms Made Simple 2024-08-07 N/A
Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter.
CVE-2011-4310 1 Cmsmadesimple 1 Cms Made Simple 2024-08-07 7.5 High
The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.
CVE-2011-3718 1 Cmsmadesimple 1 Cms Made Simple 2024-08-06 N/A
CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444.
CVE-2012-6064 1 Cmsmadesimple 1 Cms Made Simple 2024-08-06 N/A
Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.
CVE-2012-5450 1 Cmsmadesimple 1 Cms Made Simple 2024-08-06 N/A
Cross-site request forgery (CSRF) vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter.
CVE-2012-1992 1 Cmsmadesimple 1 Cms Made Simple 2024-08-06 N/A
Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).
CVE-2013-4167 1 Cmsmadesimple 1 Cms Made Simple 2024-08-06 N/A
Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) before 1.11.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.