CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 1CVE-2010-3884 – CMS Made Simple 1.7 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2010-3884
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Una vulnerabilidad de falsificación de petición en sitios cruzados en CMS Made Simple v1.8.1 y anteriores permite a atacantes remotos secuestrar la autenticación de los administradores en las solicitudes que reseteo de la contraseña de administración. NOTA: la procedencia de esta información es desconocida, los detalles son obtenidos exclusivamente de la información de terceros. • https://www.exploit-db.com/exploits/12009 http://secunia.com/advisories/40031 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 0%CPEs: 74EXPL: 0CVE-2010-3883
https://notcve.org/view.php?id=CVE-2010-3883
Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications. Vulnerabilidad de falsificación de petición en sitios (CSRF) en el modulo de cambio de permisos de grupo en CMS Made Simple v1.7.1 y anteriores permite a atacantes remotos secuestrar la autenticación de los usuarios de su elección en las solicitudes que hacen de modificaciones de permiso. • http://secunia.com/advisories/40031 http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 72EXPL: 2CVE-2010-1482 – O2 Classic Router Cross Site Request Forgery / Cross Site Scripting
https://notcve.org/view.php?id=CVE-2010-1482
Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en admin/editprefs.php en el backend de CMS Made Simple (CMSMS) antes de v1.7.1 podría permitir a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro date_format_string. O2 Classic Router suffers from cross site request forgery and cross site scripting vulnerabilities. • http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html http://www.securityfocus.com/archive/1/511178 http://www.securityfocus.com/bid/39997 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 5%CPEs: 1EXPL: 1CVE-2007-6656 – CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection
https://notcve.org/view.php?id=CVE-2007-6656
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter. Vulnerabilidad de inyección SQL en content_css.php del módulo TinyMCE para CMS Made Simple 1.2.2 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro templateid. • https://www.exploit-db.com/exploits/4810 http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123 http://forum.cmsmadesimple.org/index.php/topic%2C18240.0.html http://osvdb.org/39788 http://secunia.com/advisories/28285 http://www.securityfocus.com/bid/27074 https://exchange.xforce.ibmcloud.com/vulnerabilities/39311 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 3CVE-2007-2473 – CMS Made Simple 1.0.5 - 'Stylesheet.php' SQL Injection
https://notcve.org/view.php?id=CVE-2007-2473
SQL injection vulnerability in stylesheet.php in CMS Made Simple 1.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter. Vulnerabilidad de inyección SQL en el stylesheet.php del CMS Made Simple 1.0.5 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro templateid. • https://www.exploit-db.com/exploits/29941 http://blog.cmsmadesimple.org/2007/04/24/cms-made-simple-106-released http://osvdb.org/35744 http://secunia.com/advisories/25082 http://www.scanit.be/advisory-2007-05-02.html http://www.securityfocus.com/bid/23753 http://www.vupen.com/english/advisories/2007/1628 https://exchange.xforce.ibmcloud.com/vulnerabilities/34044 •