CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-6070
https://notcve.org/view.php?id=CVE-2017-6070
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form. CMS Made Simple versión 1.x Form Builder antes de la versión 0.8.1.6 permite a atacantes remotos ejecutar código PHP a través del parámetro cntnt01fbrp_forma_form_template en admin_store_form. • http://dev.cmsmadesimple.org/project/files/69 https://daylight-it.com/security-advisory-dlcs0001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7904
https://notcve.org/view.php?id=CVE-2016-7904
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request. Vulnerabilidad de CSRF en CMS Made Simple en versiones anteriores a 2.1.6 permite a atacantes remotos secuestrar la autenticación de administradores para peticiones que crean cuentas a través de una petición admin/adduser.php. • http://dev.cmsmadesimple.org/project/changelog/5392 http://www.openwall.com/lists/oss-security/2017/01/16/1 http://www.securityfocus.com/bid/95453 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.7EPSS: 94%CPEs: 80EXPL: 1CVE-2016-2784 – CMS Made Simple < 1.12.1 / < 2.1.3 - Web Server Cache Poisoning
https://notcve.org/view.php?id=CVE-2016-2784
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request. CMS Made Simple 2.x en versiones anteriores a 2.1.3 y 1.x en versiones anteriores a 1.12.2, cuando está activada la Smarty Cache, permiten a atacantes remotos llevar a cabo ataques de envenenamiento de la caché, modificar enlaces y llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) a través de una cabecera HTTP Host manipulada en una petición. CMS Made Simple versions prior to 2.1.3 and 1.12.2 suffer from a web server cache poisoning vulnerability. • https://www.exploit-db.com/exploits/39760 http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html http://seclists.org/fulldisclosure/2016/May/15 http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point http://www.securityfocus.com/archive/1/538272/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 64EXPL: 0CVE-2014-2245
https://notcve.org/view.php?id=CVE-2014-2245
SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information. Vulnerabilidad de inyección SQL en el módulo News en CMS Made Simple (CMSMS) anterior a 1.11.10 permite a usuarios remotos autenticados con el permiso "Modify News" ejecutar comandos SQL arbitrarios a través del parámetro sortby hacia admin/moduleinterface.php. NOTA: algunos de estos detalles se obtiene de información de terceras partes. • http://dev.cmsmadesimple.org/project/changelog/4602 http://seclists.org/oss-sec/2014/q1/467 http://secunia.com/advisories/56996 http://www.securityfocus.com/bid/65953 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2014-2092
https://notcve.org/view.php?id=CVE-2014-2092
Cross-site scripting (XSS) vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that may not cross privilege boundaries. Vulnerabilidad de XSS en lib/filemanager/ImageManager/editorFrame.php en CMS Made Simple 1.11.10 permite a atacantes remotos inyectar script Web o HTML arbitrarios a través del parámetro action, un problema diferente a CVE-2014-0334. NOTA: la divulgación original también informó de problemas que pueden no cruzar límites de privilegio. • http://packetstormsecurity.com/files/125353/CMSMadeSimple-1.11.10-Cross-Site-Scripting.html http://www.securityfocus.com/bid/65746 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •