Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: CMS Made Simple Clear all filters
TI-2024-01426 CVE-2024-1529 · GHSA-x6pc-98xx-mqg4

Cross-site Scripting in CMS Made Simple

Priority LOW 35

Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/adduser.php, in multiple parameters.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00436 Published 2024-03-12 No fix listed CWE-79
TI-2024-01425 CVE-2024-1528 · GHSA-hjxq-rqvr-4hp2

Cross-site Scripting in CMS Made Simple

Priority LOW 33

CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/moduleinterface.php, in multiple parameters.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00436 Published 2024-03-12 No fix listed CWE-79
TI-2008-02173 CVE-2008-2267 · GHSA-rp7v-2qhc-44h3

Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module…

Priority MEDIUM 41

Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04808 Published 2008-05-16 No fix listed CWE-20