CVSS: 7.2EPSS: 1%CPEs: 1EXPL: 0CVE-2019-9058
https://notcve.org/view.php?id=CVE-2019-9058
26 Mar 2019 — An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups parameter that leads to authenticated object injection. Se ha descubierto un problema en CMS Made Simple 2.2.8. En la página de administrador en admin/changegroupperm.php, es posible enviar un valor manipulado en el parámetro sel_groups que conduce a una inyección de objetos autenticada. • https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9057
https://notcve.org/view.php?id=CVE-2019-9057
26 Mar 2019 — An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection. Se ha descubierto un problema en CMS Made Simple 2.2.8. En el módulo FilePicker, es posible alcanzar una llamada no serializada con un parámetro no fiable y lograr inyectar objetos autenticados. • https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg • CWE-502: Deserialization of Untrusted Data CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes •
CVSS: 8.8EPSS: 31%CPEs: 1EXPL: 1CVE-2019-9055 – CMS Made Simple 2.2.8 Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9055
26 Mar 2019 — An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with an unprivileged user with Designer permission, it is possible reach an unserialize call with a crafted value in the m1_allparms parameter, and achieve object injection. Se ha descubierto un problema en CMS Made Simple 2.2.8. En el módulo DesignManager (en los archivos action.admin_bulk_css.php y action.admin_bulk_template.php), con un usuario sin pri... • https://packetstorm.news/files/id/155322 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.1EPSS: 92%CPEs: 1EXPL: 30CVE-2019-9053 – CMS Made Simple < 2.2.10 - SQL Injection
https://notcve.org/view.php?id=CVE-2019-9053
26 Mar 2019 — An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter. Se ha descubierto un problema en CMS Made Simple 2.2.8. En el módulo News, mediante una URL manipulada, es posible lograr una inyección SQL ciega basada en tiempo mediante el parámetro m1_idlist. CMS Made Simple versions prior to 2.2.10 suffer from a remote SQL injection vulnerability. • https://packetstorm.news/files/id/152356 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 61%CPEs: 1EXPL: 5CVE-2019-9692 – CMS Made Simple (CMSMS) Showtime2 - File Upload Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9692
11 Mar 2019 — class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG). class.showtime2_image.php en CMS Made Simple (CMSMS), en versiones anteriores a la 2.2.10, no garantiza que un archivo con marca de agua tenga una extensión de archivos estándar (GIF, JPG, JPEG o PNG). • https://packetstorm.news/files/id/152269 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9693
https://notcve.org/view.php?id=CVE-2019-9693
11 Mar 2019 — In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id). En CMS Made Simple (CMSMS), en versiones anteriores a la 2.2.10, un usuario autenticado puede lograr una inyección S... • http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php&rev=47 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20464
https://notcve.org/view.php?id=CVE-2018-20464
25 Dec 2018 — There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address. Hay una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en CMS Made Simple 2.2.8, en admin/myaccount.php. Esta vulnerabilidad se desencadena tras un intento de modificación de la bandeja de entrada de un usuario con el formato erróneo. • https://github.com/Xmansec/cmsms_vul • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19597
https://notcve.org/view.php?id=CVE-2018-19597
19 Dec 2018 — CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798. CMS Made Simple 2.2.8 permite Cross-Site Scripting (XSS) mediante un documento SVG manipulado. Este problema está relacionado con CVE-2017-16798. • https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 29EXPL: 0CVE-2005-2392
https://notcve.org/view.php?id=CVE-2005-2392
27 Jul 2005 — Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function. Vulnerabilidad de secuencia de comandos en sitios cruzados en index.php para CMSSimple 2.4 y anteriores permite que atacantes remotos inyecten script web arbitrario o HTML mediante el parámetro "search" en la función de búsqueda. • http://lostmon.blogspot.com/2005/07/cmsimple-search-variable-xss.html •