CVE-2020-37238 | Medium | 6.4 | 2026-05-16 | CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scr… |
CVE-2025-63678 | High | 7.2 | 2025-11-10 | An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Adminis… |
CVE-2025-5153 | Low | 3.5 | 2025-05-25 | A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Des… |
CVE-2024-1529 | High | 7.4 | 2024-03-12 | Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability thro… |
CVE-2024-1528 | High | 7.4 | 2024-03-12 | CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/modu… |
CVE-2024-1527 | Critical | 9.8 | 2024-03-12 | Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security mea… |
CVE-2024-27625 | Medium | 4.8 | 2024-03-05 | CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifica… |
CVE-2024-27623 | Medium | 5.9 | 2024-03-05 | CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, particularly when ed… |
CVE-2024-27622 | High | 7.2 | 2024-03-05 | A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises… |
CVE-2023-43352 | High | 7.8 | 2023-10-26 | An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component. |
CVE-2023-43360 | Medium | 5.4 | 2023-10-25 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parame… |
CVE-2023-43358 | Medium | 5.4 | 2023-10-23 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in t… |
CVE-2023-43357 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in t… |
CVE-2023-43356 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata par… |
CVE-2023-43355 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and passwor… |
CVE-2023-43354 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter i… |
CVE-2023-43353 | Medium | 5.4 | 2023-10-20 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in t… |
CVE-2023-43359 | Medium | 5.4 | 2023-10-19 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metada… |
CVE-2023-43872 | Medium | 5.4 | 2023-09-28 | A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS). |
CVE-2023-43339 | Medium | 6.1 | 2023-09-25 | Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Da… |
CVE-2023-36970 | Medium | 5.4 | 2023-07-06 | A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload functi… |
CVE-2023-36969 | High | 8.8 | 2023-07-06 | CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function. |
CVE-2021-28999 | High | 8.8 | 2023-05-08 | SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News… |
CVE-2021-28998 | High | 7.2 | 2023-05-08 | File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file. |
CVE-2021-40961 | High | 8.8 | 2022-06-09 | CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it… |
CVE-2021-43154 | Medium | 6.1 | 2022-04-13 | Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php. |
CVE-2022-23907 | Medium | 6.1 | 2022-02-28 | CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage. |
CVE-2022-23906 | High | 7.2 | 2022-02-28 | CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploite… |
CVE-2020-23481 | Medium | 5.4 | 2021-09-22 | CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2019-9060 | High | 7.5 | 2021-09-17 | An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setde… |
CVE-2020-22732 | Medium | 4.8 | 2021-08-05 | CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker.. |
CVE-2020-23241 | Medium | 4.8 | 2021-07-26 | Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature. |
CVE-2020-23240 | Medium | 4.8 | 2021-07-26 | Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature. |
CVE-2020-36416 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36415 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36414 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36413 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36412 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36411 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36410 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36409 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-36408 | Medium | 5.4 | 2021-07-02 | A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted pa… |
CVE-2020-27377 | Medium | 4.8 | 2021-06-01 | A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an att… |
CVE-2021-28935 | Medium | 5.4 | 2021-03-30 | CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field. |
CVE-2020-20138 | Medium | 6.1 | 2020-12-17 | Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4. |
CVE-2020-24860 | Medium | 5.4 | 2020-10-01 | CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fiel… |
CVE-2020-22842 | Medium | 5.4 | 2020-09-30 | CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php. |
CVE-2020-17462 | High | 7.8 | 2020-08-14 | CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798. |
CVE-2020-14926 | Medium | 5.4 | 2020-06-19 | CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page. |
CVE-2020-13660 | Medium | 4.8 | 2020-05-28 | CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. |
CVE-2020-10682 | High | 7.8 | 2020-03-20 | The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php… |
CVE-2020-10681 | Medium | 5.4 | 2020-03-20 | The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php. |
CVE-2011-4310 | High | 7.5 | 2019-11-26 | The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles. |
CVE-2019-17630 | Medium | 4.8 | 2019-10-16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" screen. |
CVE-2019-17629 | Medium | 4.8 | 2019-10-16 | CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload images" screen. |
CVE-2019-17226 | Medium | 4.8 | 2019-10-06 | CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. |
CVE-2019-1010290 | Medium | 6.1 | 2019-07-16 | Babel: Multilingual site Babel All is affected by: Open Redirection. The impact is: Redirection to any URL, which is supplied to redirect.php in a "newurl" par… |
CVE-2019-11226 | Medium | 5.4 | 2019-06-05 | CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News. |
CVE-2019-11513 | Medium | 4.8 | 2019-04-25 | The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. |
CVE-2019-9056 | High | 8.8 | 2019-04-11 | An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator… |
CVE-2019-10107 | Medium | 5.4 | 2019-03-26 | CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section. |
CVE-2019-10106 | Medium | 5.4 | 2019-03-26 | CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News mod… |
CVE-2019-10105 | Medium | 5.4 | 2019-03-26 | CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the… |
CVE-2019-9061 | High | 8.8 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reach an unserialize ca… |
CVE-2019-9059 | High | 7.2 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying the path of the e-ma… |
CVE-2019-9058 | High | 7.2 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the sel_groups… |
CVE-2019-9057 | High | 8.8 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achiev… |
CVE-2019-9055 | High | 8.8 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. In the module DesignManager (in the files action.admin_bulk_css.php and action.admin_bulk_template.php), with… |
CVE-2019-9053 | High | 8.1 | 2019-03-26 | An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL i… |
CVE-2019-10017 | Medium | 5.4 | 2019-03-24 | CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" action to the File Picker. |
CVE-2019-9693 | High | 8.8 | 2019-03-11 | In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter… |
CVE-2019-9692 | Medium | 6.5 | 2019-03-11 | class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, o… |
CVE-2018-20464 | Medium | 6.1 | 2018-12-25 | There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mai… |
CVE-2018-19597 | Medium | 4.8 | 2018-12-19 | CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798. |
CVE-2018-18271 | Medium | 6.1 | 2018-10-12 | XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action. |
CVE-2018-18270 | Medium | 6.1 | 2018-10-12 | XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action. |
CVE-2018-10523 | Medium | 5.3 | 2018-04-27 | CMS Made Simple (CMSMS) through 2.2.7 contains a physical path leakage Vulnerability via /modules/DesignManager/action.ajax_get_templates.php, /modules/DesignM… |
CVE-2018-10522 | Medium | 4.9 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitab… |
CVE-2018-10521 | Low | 2.7 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS… |
CVE-2018-10520 | Medium | 6.5 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause… |
CVE-2018-10519 | High | 8.8 | 2018-04-27 | CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE… |
CVE-2018-10518 | Medium | 6.5 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause D… |
CVE-2018-10517 | High | 7.2 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by a… |
CVE-2018-10516 | Medium | 6.5 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploit… |
CVE-2018-10515 | High | 7.2 | 2018-04-27 | In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an a… |
CVE-2018-9921 | Medium | 5.3 | 2018-04-23 | In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation d… |
CVE-2018-1000158 | High | 8.8 | 2018-04-18 | cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url']… |
CVE-2018-10086 | High | 7.2 | 2018-04-13 | CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function… |
CVE-2018-10085 | Critical | 9.8 | 2018-04-13 | CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.Login… |
CVE-2018-10084 | High | 8.8 | 2018-04-13 | CMS Made Simple (CMSMS) through 2.2.6 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within… |
CVE-2018-10083 | High | 7.5 | 2018-04-13 | CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val par… |
CVE-2018-10082 | Medium | 5.3 | 2018-04-13 | CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, o… |
CVE-2018-10081 | Critical | 9.8 | 2018-04-13 | CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beg… |
CVE-2018-10033 | Medium | 4.8 | 2018-04-11 | CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter. |
CVE-2018-10032 | Medium | 4.8 | 2018-04-11 | CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter. |
CVE-2018-10031 | High | 8.8 | 2018-04-11 | CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php. |
CVE-2018-10030 | High | 8.8 | 2018-04-11 | CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php. |
CVE-2018-10029 | Medium | 4.8 | 2018-04-11 | CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability… |
CVE-2018-1000092 | High | 8.8 | 2018-03-13 | CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found… |
CVE-2018-1000094 | High | 7.2 | 2018-03-13 | CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access t… |