CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2011-3718
https://notcve.org/view.php?id=CVE-2011-3718
23 Sep 2011 — CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files. NOTE: this might overlap CVE-2007-5444. CMS Made Simple (CMSMS) v1.9.2 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demo... • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 0%CPEs: 79EXPL: 0CVE-2010-4663
https://notcve.org/view.php?id=CVE-2010-4663
08 Jun 2011 — Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) before 1.9.1 has unknown impact and attack vectors. Vulnerabilidad no especificada en el módulo News en CMS Made Simple (CMSMS) anterior a v1.9.1 tiene un impacto desconocido y vectores de ataque. • http://forum.cmsmadesimple.org/viewtopic.php?t=49245 •
CVSS: 6.1EPSS: 0%CPEs: 74EXPL: 0CVE-2010-3882
https://notcve.org/view.php?id=CVE-2010-3882
08 Oct 2010 — Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.7.1 and earlier allow remote attackers to inject arbitrary web script or HTML via input to the (1) Add Pages, (2) Add Global Content, (3) Edit Global Content, (4) Add Article, (5) Add Category, (6) Add Field Definition, or (7) Add Shortcut module. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados(XSS) en CMS Made Simple v1.7.1 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML a tra... • http://secunia.com/advisories/40031 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 74EXPL: 0CVE-2010-3883
https://notcve.org/view.php?id=CVE-2010-3883
08 Oct 2010 — Cross-site request forgery (CSRF) vulnerability in the Change Group Permissions module in CMS Made Simple 1.7.1 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that make permission modifications. Vulnerabilidad de falsificación de petición en sitios (CSRF) en el modulo de cambio de permisos de grupo en CMS Made Simple v1.7.1 y anteriores permite a atacantes remotos secuestrar la autenticación de los usuarios de su elección en las solicitudes que hacen de modi... • http://secunia.com/advisories/40031 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2010-3884 – CMS Made Simple 1.7 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2010-3884
08 Oct 2010 — Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Una vulnerabilidad de falsificación de petición en sitios cruzados en CMS Made Simple v1.8.1 y anteriores permite a atacantes remotos secuestrar la autenticación de los administradores en ... • https://www.exploit-db.com/exploits/12009 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 57EXPL: 0CVE-2010-2797
https://notcve.org/view.php?id=CVE-2010-2797
08 Oct 2010 — Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642. Una vulnerabilidad de salto de directorio en lib/translation.functions.php en CMS Made Simple antes de la versión v1.8.1 permite a atacantes remotos incluir y ejecutar archivos locale... • http://cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 72EXPL: 2CVE-2010-1482
https://notcve.org/view.php?id=CVE-2010-1482
12 May 2010 — Cross-site scripting (XSS) vulnerability in admin/editprefs.php in the backend in CMS Made Simple (CMSMS) before 1.7.1 might allow remote attackers to inject arbitrary web script or HTML via the date_format_string parameter. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en admin/editprefs.php en el backend de CMS Made Simple (CMSMS) antes de v1.7.1 podría permitir a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro date_format_string. • http://blog.cmsmadesimple.org/2010/05/01/announcing-cms-made-simple-1-7-1-escade • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 6%CPEs: 1EXPL: 2CVE-2008-5642 – CMS Made Simple 1.4.1 - Local File Inclusion
https://notcve.org/view.php?id=CVE-2008-5642
17 Dec 2008 — Directory traversal vulnerability in admin/login.php in CMS Made Simple 1.4.1 allows remote attackers to read arbitrary files via a .. (dot dot) in a cms_language cookie. Vulnerabilidad de salto de directorio en admin/login.php en CMS Made Simple v1.4.1 permitiria a atacantes remotos leer ficheros a su eleccion a traves de .. (doble punto) en la cookie cms_language. • https://www.exploit-db.com/exploits/7285 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 7%CPEs: 1EXPL: 2CVE-2008-2267 – CMS Made Simple 1.2.4 Module FileManager - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2008-2267
16 May 2008 — Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/. Vulnerabilidad de lista negra incompleta en javaUpload.php de Postlet en el módulo FileManager de CMS Made Simple 1.2.4 y versione... • https://www.exploit-db.com/exploits/5600 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2007-6656 – CMS Made Simple 1.2.2 Module TinyMCE - SQL Injection
https://notcve.org/view.php?id=CVE-2007-6656
04 Jan 2008 — SQL injection vulnerability in content_css.php in the TinyMCE module for CMS Made Simple 1.2.2 and earlier allows remote attackers to execute arbitrary SQL commands via the templateid parameter. Vulnerabilidad de inyección SQL en content_css.php del módulo TinyMCE para CMS Made Simple 1.2.2 y versiones anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro templateid. • https://www.exploit-db.com/exploits/4810 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •