CVSS: 8.1EPSS: 92%CPEs: 1EXPL: 30CVE-2019-9053 – CMS Made Simple < 2.2.10 - SQL Injection
https://notcve.org/view.php?id=CVE-2019-9053
26 Mar 2019 — An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter. Se ha descubierto un problema en CMS Made Simple 2.2.8. En el módulo News, mediante una URL manipulada, es posible lograr una inyección SQL ciega basada en tiempo mediante el parámetro m1_idlist. CMS Made Simple versions prior to 2.2.10 suffer from a remote SQL injection vulnerability. • https://packetstorm.news/files/id/152356 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2019-10017
https://notcve.org/view.php?id=CVE-2019-10017
24 Mar 2019 — CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker. CMS Made Simple 2.2.10 tiene Cross-Site Scripting (XSS) mediante el campo Name en moduleinterface.php, que es alcanzable mediante la acción "Add a new Profile" en el File Picker. • http://dev.cmsmadesimple.org/bug/view/12001 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 61%CPEs: 1EXPL: 5CVE-2019-9692 – CMS Made Simple (CMSMS) Showtime2 - File Upload Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-9692
11 Mar 2019 — class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG). class.showtime2_image.php en CMS Made Simple (CMSMS), en versiones anteriores a la 2.2.10, no garantiza que un archivo con marca de agua tenga una extensión de archivos estándar (GIF, JPG, JPEG o PNG). • https://packetstorm.news/files/id/152269 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9693
https://notcve.org/view.php?id=CVE-2019-9693
11 Mar 2019 — In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id). En CMS Made Simple (CMSMS), en versiones anteriores a la 2.2.10, un usuario autenticado puede lograr una inyección S... • http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_data.php&rev=47 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20464
https://notcve.org/view.php?id=CVE-2018-20464
25 Dec 2018 — There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address. Hay una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en CMS Made Simple 2.2.8, en admin/myaccount.php. Esta vulnerabilidad se desencadena tras un intento de modificación de la bandeja de entrada de un usuario con el formato erróneo. • https://github.com/Xmansec/cmsms_vul • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-19597
https://notcve.org/view.php?id=CVE-2018-19597
19 Dec 2018 — CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798. CMS Made Simple 2.2.8 permite Cross-Site Scripting (XSS) mediante un documento SVG manipulado. Este problema está relacionado con CVE-2017-16798. • https://github.com/security-breachlock/CVE-2018-19597/blob/master/cmssms.pdf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18270
https://notcve.org/view.php?id=CVE-2018-18270
12 Oct 2018 — XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action. Existe Cross-Site Scripting (XSS) en CMS Made Simple 2.2.7 mediante el parámetro m1_news_url en una acción "Content-->News-->Add Article" en admin/moduleinterface.php. • https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/12 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-18271
https://notcve.org/view.php?id=CVE-2018-18271
12 Oct 2018 — XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action. Existe Cross-Site Scripting (XSS) en CMS Made Simple 2.2.7 mediante el parámetro m1_extra en una acción "Content-->News-->Add Article" en admin/moduleinterface.php. • https://github.com/cmsmadesimple/cmsmadesimple-2-0/issues/13 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 2%CPEs: 1EXPL: 1CVE-2018-10515
https://notcve.org/view.php?id=CVE-2018-10515
27 Apr 2018 — In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive. En CMS Made Simple (CMSMS) hasta la versión 2.2.7, la operación "file unpack" en el dashboard de administrador contiene una vulnerabilidad de ejecución remota de código explotable por un usuario administrador debido a que puede haber un archivo .php en el archivo ZIP extraído. • https://github.com/itodaro/cmsms_cve/blob/master/README.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-10516
https://notcve.org/view.php?id=CVE-2018-10516
27 Apr 2018 — In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory. En CMS Made Simple (CMSMS) hasta la versión 2.2.7, la operación "file rename" en el dashboard de administrador contiene una vulnerabilidad de divulgación de información sensible, explotable por un usuario administrador, que puede provocar una denegación de servici... • https://github.com/itodaro/cmsms_cve/blob/master/README.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •