CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2010-3884 – CMS Made Simple 1.7 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2010-3884
08 Oct 2010 — Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Una vulnerabilidad de falsificación de petición en sitios cruzados en CMS Made Simple v1.8.1 y anteriores permite a atacantes remotos secuestrar la autenticación de los administradores en ... • https://www.exploit-db.com/exploits/12009 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 57EXPL: 0CVE-2010-2797
https://notcve.org/view.php?id=CVE-2010-2797
08 Oct 2010 — Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642. Una vulnerabilidad de salto de directorio en lib/translation.functions.php en CMS Made Simple antes de la versión v1.8.1 permite a atacantes remotos incluir y ejecutar archivos locale... • http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 72EXPL: 2CVE-2010-1482
https://notcve.org/view.php?id=CVE-2010-1482
12 May 2010 — Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en admin/editprefs.php en el backend de CMS Made Simple (CMSMS) antes de v1.7.1 podría permitir a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro date_format_string. • http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 29EXPL: 0CVE-2005-2392
https://notcve.org/view.php?id=CVE-2005-2392
27 Jul 2005 — Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function. Vulnerabilidad de secuencia de comandos en sitios cruzados en index.php para CMSSimple 2.4 y anteriores permite que atacantes remotos inyecten script web arbitrario o HTML mediante el parámetro "search" en la función de búsqueda. • http://lostmon.blogspot.com/2005/07/cmsimple-search-variable-xss.html •