Cmsmadesimple
Cmsmadesimple CMS Made Simple: vulnerabilidades y CVE
Cmsmadesimple CMS Made Simple tiene 157 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 7 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE157
Últimos 12 meses3
Críticas7
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2020-37238 | Media (5.1) | 0.24% | — | 16 may 2026 | CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scripts through SVG file uploads. Attackers can upload SVG… |
| CVE-2026-5203 | Baja (2) | 0.46% | — | 31 mar 2026 | A vulnerability was found in CMS Made Simple up to 2.2.22. This impacts the function _copyFilesToFolder in the library modules/UserGuide/lib/class.UserGuideImporterExporter.php of the component UserGuide Module XML… |
| CVE-2026-4225 | Baja (1.9) | 0.35% | — | 16 mar 2026 | A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Management Module. Performing a manipulation of the argument… |
| CVE-2025-5153 | Media (5.1) | 0.35% | — | 25 may 2025 | A vulnerability, which was classified as problematic, has been found in CMS Made Simple 2.2.21. This issue affects some unknown processing of the component Design Manager Module. The manipulation of the argument… |
| CVE-2024-1529 | Media (6.1) | 0.44% | — | 12 mar 2024 | Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/adduser.php, in multiple parameters. This… |
| CVE-2024-1528 | Media (6.1) | 0.44% | — | 12 mar 2024 | CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /admin/moduleinterface.php, in multiple parameters. This vulnerability… |
| CVE-2024-1527 | Alta (8.8) | 0.92% | — | 12 mar 2024 | Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a… |
| CVE-2024-27625 | Media (4.8) | 0.41% | — | 5 mar 2024 | CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user… |
| CVE-2024-27623 | Media (5.9) | 0.43% | — | 5 mar 2024 | CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within the Design Manager, particularly when editing the Breadcrumbs. |
| CVE-2024-27622 | Alta (7.2) | 2.0% | — | 5 mar 2024 | A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the… |
| CVE-2023-43352 | Alta (7.8) | 0.53% | — | 26 oct 2023 | An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component. |
| CVE-2023-43360 | Media (5.4) | 0.54% | — | 25 oct 2023 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Top Directory parameter in the File Picker Menu component. |
| CVE-2023-43358 | Media (5.4) | 0.50% | — | 23 oct 2023 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the News Menu component. |
| CVE-2023-43357 | Media (5.4) | 0.46% | — | 20 oct 2023 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title parameter in the Manage Shortcuts component. |
| CVE-2023-43356 | Media (5.4) | 0.46% | — | 20 oct 2023 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Global Meatadata parameter in the Global Settings Menu component. |
| CVE-2023-43355 | Media (5.4) | 0.48% | — | 20 oct 2023 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the password and password again parameters in the My Preferences - Add user… |
| CVE-2023-43354 | Media (5.4) | 0.46% | — | 20 oct 2023 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles parameter in the Extensions -MicroTiny WYSIWYG editor component. |
| CVE-2023-43353 | Media (5.4) | 0.47% | — | 20 oct 2023 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the extra parameter in the news menu component. |
| CVE-2023-43359 | Media (5.4) | 0.46% | — | 19 oct 2023 | Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu… |
| CVE-2023-43872 | Media (5.4) | 0.62% | — | 28 sept 2023 | A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS). |
| CVE-2023-43339 | Media (6.1) | 0.70% | — | 25 sept 2023 | Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the Database Name, DataBase User or Database Port components. |
| CVE-2023-36970 | Media (5.4) | 0.58% | — | 6 jul 2023 | A Cross-site scripting (XSS) vulnerability in CMS Made Simple v2.2.17 allows remote attackers to inject arbitrary web script or HTML via the File Upload function. |
| CVE-2023-36969 | Alta (8.8) | 49% | — | 6 jul 2023 | CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function. |
| CVE-2021-28999 | Alta (8.8) | 1.3% | — | 8 may 2023 | SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php. |
| CVE-2021-28998 | Alta (7.2) | 1.3% | — | 8 may 2023 | File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file. |
| CVE-2021-40961 | Alta (8.8) | 1.8% | — | 9 jun 2022 | CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using… |
| CVE-2021-43154 | Media (6.1) | 0.56% | — | 13 abr 2022 | Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php. |
| CVE-2022-23907 | Media (6.1) | 0.64% | — | 28 feb 2022 | CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage. |
| CVE-2022-23906 | Alta (7.2) | 2.2% | — | 28 feb 2022 | CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file. |
| CVE-2020-23481 | Media (5.4) | 0.48% | — | 22 sept 2021 | CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field. |