CMS Made Simple 2.2.14

CPE Details

CMS Made Simple 2.2.14
cmsmadesimple
cms_made_simple
2.2.14
2020-05-29
12h50 +00:00
2020-05-29
12h50 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.14:*:*:*:*:*:*:*

Informations

Vendor

cmsmadesimple

Product

cms_made_simple

Version

2.2.14

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-1529 2024-03-12 15h25 +00:00 Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/adduser.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to an authenticated user and partially take over their browser session.
7.4
Haute
CVE-2024-1528 2024-03-12 15h22 +00:00 CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/moduleinterface.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.
7.4
Haute
CVE-2024-1527 2024-03-12 15h19 +00:00 Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell.
9.8
Critique
CVE-2021-28998 2023-05-08 00h00 +00:00 File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file.
7.2
Haute
CVE-2021-28999 2023-05-08 00h00 +00:00 SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php.
8.8
Haute
CVE-2021-40961 2022-06-08 22h00 +00:00 CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '.
8.8
Haute
CVE-2020-23481 2021-09-22 17h47 +00:00 CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field.
5.4
Moyen
CVE-2020-22732 2021-08-05 14h24 +00:00 CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..
4.8
Moyen
CVE-2020-23241 2021-07-26 18h12 +00:00 Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.
4.8
Moyen
CVE-2020-23240 2021-07-26 18h06 +00:00 Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.
4.8
Moyen
CVE-2020-36416 2021-07-02 15h52 +00:00 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Design" parameter under the "Designs" module.
5.4
Moyen
CVE-2020-36415 2021-07-02 15h51 +00:00 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Create a new Stylesheet" parameter under the "Stylesheets" module.
5.4
Moyen
CVE-2020-36414 2021-07-02 15h51 +00:00 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "URL (slug)" or "Extra" fields under the "Add Article" feature.
5.4
Moyen
CVE-2020-36413 2021-07-02 15h51 +00:00 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Exclude these IP addresses from the "Site Down" status" parameter under the "Maintenance Mode" module.
5.4
Moyen
CVE-2020-36412 2021-07-02 15h51 +00:00 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Search Text" field under the "Admin Search" module.
5.4
Moyen
CVE-2020-36411 2021-07-02 15h51 +00:00 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Path for the {page_image} tag:" or "Path for thumbnail field:" parameters under the "Content Editing Settings" module.
5.4
Moyen
CVE-2020-36410 2021-07-02 15h51 +00:00 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Email address to receive notification of news submission" parameter under the "Options" module.
5.4
Moyen
CVE-2020-36409 2021-07-02 15h51 +00:00 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Category" parameter under the "Categories" module.
5.4
Moyen
CVE-2020-36408 2021-07-02 15h51 +00:00 A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add Shortcut" parameter under the "Manage Shortcuts" module.
5.4
Moyen
CVE-2020-27377 2021-06-01 12h57 +00:00 A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 which allows an attacker to execute arbitrary web scripts.
4.8
Moyen
CVE-2020-24860 2020-10-01 11h55 +00:00 CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
5.4
Moyen
CVE-2020-22842 2020-09-30 01h12 +00:00 CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.
5.4
Moyen
CVE-2020-17462 2020-08-14 12h10 +00:00 CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.
7.8
Haute
CVE-2020-14926 2020-06-19 15h03 +00:00 CMS Made Simple 2.2.14 allows XSS via a Search Term to the admin/moduleinterface.php?mact=ModuleManager page.
5.4
Moyen
CVE-2020-13660 2020-05-28 16h53 +00:00 CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
4.8
Moyen
CVE-2017-1000453 2018-01-02 17h00 +00:00 CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating injection in some core modules, resulting in unauthenticated PHP code execution.
9.8
Critique
CVE-2017-1000454 2018-01-02 17h00 +00:00 CMS Made Simple 2.1.6, 2.2, 2.2.1 are vulnerable to Smarty Template Injection in some core components, resulting in local file read before 2.2, and local file inclusion since 2.2.1
7.8
Haute
CVE-2014-0334 2014-03-02 16h00 +00:00 Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092.
3.5
CVE-2007-5056 2007-09-24 20h00 +00:00 Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter.
6.8