CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-6070
https://notcve.org/view.php?id=CVE-2017-6070
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form. CMS Made Simple versión 1.x Form Builder antes de la versión 0.8.1.6 permite a atacantes remotos ejecutar código PHP a través del parámetro cntnt01fbrp_forma_form_template en admin_store_form. • http://dev.cmsmadesimple.org/project/files/69 https://daylight-it.com/security-advisory-dlcs0001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 1CVE-2017-6071
https://notcve.org/view.php?id=CVE-2017-6071
CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to conduct information-disclosure attacks via exportxml. CMS Made Simple versión 1.x Form Builder antes de la versión 0.8.1.6 permite a atacantes remotos llevar a cabo ataques de divulgación de información a través de exportxml. • http://dev.cmsmadesimple.org/project/files/69 https://daylight-it.com/security-advisory-dlcs0001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2016-7904
https://notcve.org/view.php?id=CVE-2016-7904
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple before 2.1.6 allows remote attackers to hijack the authentication of administrators for requests that create accounts via an admin/adduser.php request. Vulnerabilidad de CSRF en CMS Made Simple en versiones anteriores a 2.1.6 permite a atacantes remotos secuestrar la autenticación de administradores para peticiones que crean cuentas a través de una petición admin/adduser.php. • http://dev.cmsmadesimple.org/project/changelog/5392 http://www.openwall.com/lists/oss-security/2017/01/16/1 http://www.securityfocus.com/bid/95453 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.7EPSS: 94%CPEs: 80EXPL: 1CVE-2016-2784 – CMS Made Simple < 1.12.1 / < 2.1.3 - Web Server Cache Poisoning
https://notcve.org/view.php?id=CVE-2016-2784
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request. CMS Made Simple 2.x en versiones anteriores a 2.1.3 y 1.x en versiones anteriores a 1.12.2, cuando está activada la Smarty Cache, permiten a atacantes remotos llevar a cabo ataques de envenenamiento de la caché, modificar enlaces y llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) a través de una cabecera HTTP Host manipulada en una petición. CMS Made Simple versions prior to 2.1.3 and 1.12.2 suffer from a web server cache poisoning vulnerability. • https://www.exploit-db.com/exploits/39760 http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html http://seclists.org/fulldisclosure/2016/May/15 http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point http://www.securityfocus.com/archive/1/538272/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 64EXPL: 0CVE-2014-2245
https://notcve.org/view.php?id=CVE-2014-2245
SQL injection vulnerability in the News module in CMS Made Simple (CMSMS) before 1.11.10 allows remote authenticated users with the "Modify News" permission to execute arbitrary SQL commands via the sortby parameter to admin/moduleinterface.php. NOTE: some of these details are obtained from third party information. Vulnerabilidad de inyección SQL en el módulo News en CMS Made Simple (CMSMS) anterior a 1.11.10 permite a usuarios remotos autenticados con el permiso "Modify News" ejecutar comandos SQL arbitrarios a través del parámetro sortby hacia admin/moduleinterface.php. NOTA: algunos de estos detalles se obtiene de información de terceras partes. • http://dev.cmsmadesimple.org/project/changelog/4602 http://seclists.org/oss-sec/2014/q1/467 http://secunia.com/advisories/56996 http://www.securityfocus.com/bid/65953 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •