CVSS: 7.5EPSS: 13%CPEs: 1EXPL: 2CVE-2008-2267 – CMS Made Simple 1.2.4 Module FileManager - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2008-2267
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/. Vulnerabilidad de lista negra incompleta en javaUpload.php de Postlet en el módulo FileManager de CMS Made Simple 1.2.4 y versiones anteriores permite a atacantes remotos ejecutar código de su elección mediante la subida de un fichero con un nombre finalizado en (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, o (7) .jar, entonces accede a través de una petición directa a el fichero en modules/FileManager/postlet/. • https://www.exploit-db.com/exploits/5600 http://blog.cmsmadesimple.org/2008/05/12/announcing-cms-made-simple-125 http://secunia.com/advisories/30208 http://www.attrition.org/pipermail/vim/2008-May/001978.html http://www.securityfocus.com/bid/29170 https://exchange.xforce.ibmcloud.com/vulnerabilities/42371 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 8%CPEs: 1EXPL: 1CVE-2007-6656 – CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection
https://notcve.org/view.php?id=CVE-2007-6656
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter. Vulnerabilidad de inyección SQL en content_css.php del módulo TinyMCE para CMS Made Simple 1.2.2 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro templateid. • https://www.exploit-db.com/exploits/4810 http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123 http://forum.cmsmadesimple.org/index.php/topic%2C18240.0.html http://osvdb.org/39788 http://secunia.com/advisories/28285 http://www.securityfocus.com/bid/27074 https://exchange.xforce.ibmcloud.com/vulnerabilities/39311 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5443
https://notcve.org/view.php?id=CVE-2007-5443
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en CMS Made Simple 1.1.3.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados relacionados con (1) la etiqueta anchor (ancla) y (2) etiquetas de lista (listtags). • http://blog.cmsmadesimple.org/2007/10/07/announcing-cms-made-simple-1141 http://osvdb.org/42471 http://osvdb.org/42472 http://securityreason.com/securityalert/3223 http://www.securityfocus.com/archive/1/481984/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5444
https://notcve.org/view.php?id=CVE-2007-5444
CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files. CMS Made Simple 1.1.3.1 permite a atacantes remotos obtener la ruta completa mediante una petición directa de archivos no especificados. • http://osvdb.org/41033 http://securityreason.com/securityalert/3223 http://www.securityfocus.com/archive/1/481984/100/0/threaded • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-5442
https://notcve.org/view.php?id=CVE-2007-5442
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors. CMS Made Simple 1.1.3.1 no comprueba los permisos asignados a los usuarios que intentan enviar archivos, lo cual permite a usuarios autenticados remotamente enviar archivos no especificados a través de vectores desconocidos. • http://securityreason.com/securityalert/3223 http://www.securityfocus.com/archive/1/481984/100/0/threaded • CWE-264: Permissions, Privileges, and Access Controls •