CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-10029
https://notcve.org/view.php?id=CVE-2018-10029
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799. CMS Made Simple (también conocido como CMSMS) 2.2.7 tiene Cross-Site Scripting (XSS) reflejado en admin/moduleinterface.php a través del parámetro m1_name. Esto está relacionado con con moduledepends y es una vulnerabilidad diferente de CVE-2017-16799. • https://github.com/zxyxx/cmsms_vul • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-10030
https://notcve.org/view.php?id=CVE-2018-10030
CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php. CMS Made Simple (también conocido como CMSMS) 2.2.7 tiene Cross-Site Request Forgery (CSRF) en admin/siteprefs.php. • https://github.com/zxyxx/cmsms_vul • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-10032
https://notcve.org/view.php?id=CVE-2018-10032
CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter. CMS Made Simple (también conocido como CMSMS) 2.2.7 tiene Cross-Site Scripting (XSS) reflejado en admin/moduleinterface.php a través del parámetro m1_version. • https://github.com/zxyxx/cmsms_vul • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-10033
https://notcve.org/view.php?id=CVE-2018-10033
CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter. CMS Made Simple (también conocido como CMSMS) 2.2.7 tiene Cross-Site Scripting (XSS) persistente en admin/siteprefs.php a través del parámetro metadata. • https://github.com/zxyxx/cmsms_vul • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 8%CPEs: 1EXPL: 2CVE-2018-7448 – CMS Made Simple 2.1.6 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-7448
Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure. Vulnerabilidad de ejecución remota de código en /cmsms-2.1.6-install.php/index.php en CMS Made Simple 2.1.6 permite que atacantes remotos inyecten código PHP arbitrario mediante el parámetro "timezone" en el paso 4 del procedimiento de nueva instalación. CMS Made Simple version 2.1.6 suffers from a remote code execution vulnerability during install time. • https://www.exploit-db.com/exploits/44192 http://dev.cmsmadesimple.org/project/changelog/5471 https://packetstormsecurity.com/files/146568/CMS-Made-Simple-2.1.6-Remote-Code-Execution.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •