Filtered by vendor Cmsimple
Subscribe
Total
15 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-57546 | 1 Cmsimple | 1 Cmsimple | 2025-04-16 | N/A | 7.5 HIGH |
| An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function. | |||||
| CVE-2024-33423 | 1 Cmsimple | 1 Cmsimple | 2025-04-14 | N/A | 7.4 HIGH |
| Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section. | |||||
| CVE-2024-33424 | 1 Cmsimple | 1 Cmsimple | 2025-04-14 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section. | |||||
| CVE-2024-32392 | 1 Cmsimple | 1 Cmsimple | 2025-04-14 | N/A | 4.5 MEDIUM |
| Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component. | |||||
| CVE-2014-2219 | 1 Cmsimple | 1 Cmsimple Classic | 2025-04-12 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter. | |||||
| CVE-2024-57547 | 1 Cmsimple | 1 Cmsimple | 2025-04-11 | N/A | 7.5 HIGH |
| Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the Functionality of downloading php backup files. | |||||
| CVE-2024-57548 | 1 Cmsimple | 1 Cmsimple | 2025-04-11 | N/A | 9.1 CRITICAL |
| CMSimple 5.16 allows the user to edit log.php file via print page. | |||||
| CVE-2024-57549 | 1 Cmsimple | 1 Cmsimple | 2025-04-11 | N/A | 7.5 HIGH |
| CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request. | |||||
| CVE-2024-32344 | 1 Cmsimple | 1 Cmsimple | 2025-04-11 | N/A | 6.8 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit parameter under the Language section. | |||||
| CVE-2024-32345 | 1 Cmsimple | 1 Cmsimple | 2025-04-11 | N/A | 7.2 HIGH |
| A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Configuration parameter under the Language section. | |||||
| CVE-2008-2650 | 1 Cmsimple | 1 Cmsimple | 2025-04-09 | 6.8 MEDIUM | N/A |
| Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number. | |||||
| CVE-2021-43742 | 1 Cmsimple | 1 Cmsimple | 2024-11-21 | 3.5 LOW | 5.4 MEDIUM |
| CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature. | |||||
| CVE-2021-43741 | 1 Cmsimple | 1 Cmsimple | 2024-11-21 | 7.5 HIGH | 9.8 CRITICAL |
| CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution. | |||||
| CVE-2018-19508 | 1 Cmsimple | 1 Cmsimple | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI. | |||||
| CVE-2018-19507 | 1 Cmsimple | 1 Cmsimple | 2024-11-21 | 3.5 LOW | 4.8 MEDIUM |
| CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI. | |||||