CVSS: 6.8EPSS: 0%CPEs: 74EXPL: 0CVE-2010-3883
https://notcve.org/view.php?id=CVE-2010-3883
Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications. Vulnerabilidad de falsificación de petición en sitios (CSRF) en el modulo de cambio de permisos de grupo en CMS Made Simple v1.7.1 y anteriores permite a atacantes remotos secuestrar la autenticación de los usuarios de su elección en las solicitudes que hacen de modificaciones de permiso. • http://secunia.com/advisories/40031 http://security.bkis.com/multiple-vulnerabilities-in-cms-made-simple • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 72EXPL: 2CVE-2010-1482 – O2 Classic Router Cross Site Request Forgery / Cross Site Scripting
https://notcve.org/view.php?id=CVE-2010-1482
Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en admin/editprefs.php en el backend de CMS Made Simple (CMSMS) antes de v1.7.1 podría permitir a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro date_format_string. O2 Classic Router suffers from cross site request forgery and cross site scripting vulnerabilities. • http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade http://int21.de/cve/CVE-2010-1482-cmsmadesimple-xss-backend.html http://www.securityfocus.com/archive/1/511178 http://www.securityfocus.com/bid/39997 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 2%CPEs: 1EXPL: 2CVE-2008-5642 – CMS Made Simple 1.4.1 - Local File Inclusion
https://notcve.org/view.php?id=CVE-2008-5642
Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie. Vulnerabilidad de salto de directorio en admin/login.php en CMS Made Simple v1.4.1 permitiria a atacantes remotos leer ficheros a su eleccion a traves de .. (doble punto) en la cookie cms_language. • https://www.exploit-db.com/exploits/7285 http://secunia.com/advisories/32924 http://securityreason.com/securityalert/4775 http://www.securityfocus.com/bid/32535 http://www.vupen.com/english/advisories/2008/3306 https://exchange.xforce.ibmcloud.com/vulnerabilities/46942 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 13%CPEs: 1EXPL: 2CVE-2008-2267 – CMS Made Simple 1.2.4 Module FileManager - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2008-2267
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/. Vulnerabilidad de lista negra incompleta en javaUpload.php de Postlet en el módulo FileManager de CMS Made Simple 1.2.4 y versiones anteriores permite a atacantes remotos ejecutar código de su elección mediante la subida de un fichero con un nombre finalizado en (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, o (7) .jar, entonces accede a través de una petición directa a el fichero en modules/FileManager/postlet/. • https://www.exploit-db.com/exploits/5600 http://blog.cmsmadesimple.org/2008/05/12/announcing-cms-made-simple-125 http://secunia.com/advisories/30208 http://www.attrition.org/pipermail/vim/2008-May/001978.html http://www.securityfocus.com/bid/29170 https://exchange.xforce.ibmcloud.com/vulnerabilities/42371 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 8%CPEs: 1EXPL: 1CVE-2007-6656 – CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection
https://notcve.org/view.php?id=CVE-2007-6656
SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter. Vulnerabilidad de inyección SQL en content_css.php del módulo TinyMCE para CMS Made Simple 1.2.2 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro templateid. • https://www.exploit-db.com/exploits/4810 http://blog.cmsmadesimple.org/2008/01/02/announcing-cms-made-simple-123 http://forum.cmsmadesimple.org/index.php/topic%2C18240.0.html http://osvdb.org/39788 http://secunia.com/advisories/28285 http://www.securityfocus.com/bid/27074 https://exchange.xforce.ibmcloud.com/vulnerabilities/39311 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •