CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9060
https://notcve.org/view.php?id=CVE-2019-9060
An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1). Se ha detectado un problema en CMS Made Simple versión 2.2.8. Es posible lograr un salto de ruta no autenticado en el módulo CGExtensions (en el archivo action.setdefaulttemplate.php) con el parámetro m1_filename; y mediante el archivo action.showmessage.php, es posible leer el contenido de un archivo arbitrario (al usar ese salto de ruta con m1_prefname establecido en cg_errormsg y m1_resettodefault=1) • http://dev.cmsmadesimple.org/project/changelog/5819 https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285 https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-22732
https://notcve.org/view.php?id=CVE-2020-22732
CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker.. CMS Made Simple (CMSMS) versión 2.2.14, permite un ataque de tipo XSS almacenado por medio de las Extensiones ) Fie Picker.. • http://dev.cmsmadesimple.org/bug/view/12288 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23241
https://notcve.org/view.php?id=CVE-2020-23241
Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en CMS Made Simple versión 2.2.14, en "Extra" por medio de la funcionalidad "News ) Article" • http://dev.cmsmadesimple.org/bug/view/12322 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23240
https://notcve.org/view.php?id=CVE-2020-23240
Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en CMS Made Simple versión 2.2.14 por medio del campo Logic en la funcionalidad Content Manager • http://dev.cmsmadesimple.org/bug/view/12321 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36416
https://notcve.org/view.php?id=CVE-2020-36416
A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module. Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en CMS Made Simple versión 2.2.14, permite a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de una carga útil diseñada introducida en el parámetro "Create a new Design" en el módulo "Designs" • http://dev.cmsmadesimple.org/bug/view/12325 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •