CVSS: 9.8EPSS: 17%CPEs: 1EXPL: 4CVE-2017-16783 – CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection
https://notcve.org/view.php?id=CVE-2017-16783
10 Nov 2017 — In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter. En CMS Made Simple 2.1.6, existe inyección de plantillas del lado del servidor mediante el parámetro cntnt01detailtemplate. CMS Made Simple version 2.1.6 suffers from cross site scripting and server-side template injection vulnerabilities. • https://packetstorm.news/files/id/159690 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16784
https://notcve.org/view.php?id=CVE-2017-16784
10 Nov 2017 — In CMS Made Simple 2.2.2, there is Reflected XSS via the cntnt01detailtemplate parameter. En CMS Made Simple 2.2.2, existe Cross-Site Scripting (XSS) reflejado mediante el parámetro cntnt01detailtemplate. • https://www.netsparker.com/web-applications-advisories/ns-17-031-reflected-xss-vulnerability-in-cms-made-simple • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11404
https://notcve.org/view.php?id=CVE-2017-11404
18 Jul 2017 — In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileManager action to admin/moduleinterface.php. En CMS Made Simple (CMSMS) versión 2.2.2, los administradores autenticados remotos pueden cargar un archivo .php por medio de una acción FileManager en el archivo admin/moduleinterface.php. • http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/images/upload_vulnerability_yuesec.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11405
https://notcve.org/view.php?id=CVE-2017-11405
18 Jul 2017 — In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSContentManager action to admin/moduleinterface.php, followed by a FilePicker action to admin/moduleinterface.php in which type=image is changed to type=file. En CMS Made Simple (CMSMS) versión 2.2.2, los administradores autenticados remotos pueden cargar un archivo .php por medio de una acción CMSContentManager en el archivo admin/moduleinterface.php, seguido por una acción FilePicker en el archivo admin/mo... • http://www.yuesec.com/img/cccccve/CMSMadeSimple/upl0advul123/filepickerimages/FilePicker_upload_vulnerability.html • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-9668
https://notcve.org/view.php?id=CVE-2017-9668
18 Jun 2017 — In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generation, via the description parameter in an addgroup action. En admin\addgroup.php en el gestor de contenidos Made Simple 2.1.6, cuando se añade un nuevo grupo no filtra el XSS resultando en la generación de un Storage-type XSS, mediante el parametro de descripción en la acción de añadir grupo. • https://github.com/XiaoZhis/ProjectSend/issues/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 3%CPEs: 1EXPL: 1CVE-2017-8912 – CMS Made Simple 2.1.6 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2017-8912
12 May 2017 — CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug. ** EN DISPUTA** CMS Made Simple (CMSMS) 2.1.6 permite a los administradores autenticados remotos ejecutar código PHP arbitrario a través del parámetro de código admin/editusertag.php, relativo a las funciones CreateTagFunction y C... • https://www.exploit-db.com/exploits/41997 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7255
https://notcve.org/view.php?id=CVE-2017-7255
24 Mar 2017 — XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_title parameter. Someone must login to conduct the attack. XSS existe en la característica CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" a través del parámetro m1_title. Alguien debe iniciar sesión para realizar el ataque. • http://www.03i0.com/index.php/archives/113 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7256
https://notcve.org/view.php?id=CVE-2017-7256
24 Mar 2017 — XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_summary parameter. Someone must login to conduct the attack. XSS existe en la característica CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" característica a través del parámetro m1_summary. Alguien debe iniciar sesión para realizar el ataque. • http://www.03i0.com/index.php/archives/113 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-7257
https://notcve.org/view.php?id=CVE-2017-7257
24 Mar 2017 — XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack. XSS existe en la característica CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" a través del parámetro m1_content. Alguien debe iniciar sesión para realizar el ataque. • http://www.03i0.com/index.php/archives/113 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-6555
https://notcve.org/view.php?id=CVE-2017-6555
09 Mar 2017 — Cross-site scripting (XSS) vulnerability in /admin/moduleinterface.php in CMS Made Simple 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the m1_description parameter (aka "Design Manager > Categories > Category Description"). Vulnerabilidad de XSS en /admin/moduleinterface.php en CMS Made Simple 2.1.6 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro m1_description (vulnerabilidad también conocida como "D... • http://www.daimacn.com/?id=7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •