Filtered by vendor Cmsimple
Subscriptions
Filtered by product Cmsimple
Subscriptions
Total
5 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2021-43742 | 1 Cmsimple | 1 Cmsimple | 2022-08-06 | 5.4 Medium |
CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature. | ||||
CVE-2021-43741 | 1 Cmsimple | 1 Cmsimple | 2022-04-20 | 9.8 Critical |
CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution. | ||||
CVE-2018-19508 | 1 Cmsimple | 1 Cmsimple | 2019-02-26 | N/A |
CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI. | ||||
CVE-2018-19507 | 1 Cmsimple | 1 Cmsimple | 2019-02-25 | N/A |
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI. | ||||
CVE-2008-2650 | 1 Cmsimple | 1 Cmsimple | 2017-09-29 | N/A |
Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.php and then invoking the upload action. NOTE: on 20080601, the vendor patched 3.1 without changing the version number. |
Page 1 of 1.