Vulnerabilities > Cmsmadesimple > CMS Made Simple > 2.2.10

DATE CVE VULNERABILITY TITLE RISK
2023-05-08 CVE-2021-28998 Unrestricted Upload of File with Dangerous Type vulnerability in Cmsmadesimple CMS Made Simple
File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file.
network
low complexity
cmsmadesimple CWE-434
7.2
7.2
2023-05-08 CVE-2021-28999 SQL Injection vulnerability in Cmsmadesimple CMS Made Simple
SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php.
network
low complexity
cmsmadesimple CWE-89
8.8
8.8
2022-06-09 CVE-2021-40961 SQL Injection vulnerability in Cmsmadesimple CMS Made Simple
CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php.
network
low complexity
cmsmadesimple CWE-89
8.8
8.8
2020-09-30 CVE-2020-22842 Cross-site Scripting vulnerability in Cmsmadesimple CMS Made Simple
CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php. 		3.5
3.5
2020-05-28 CVE-2020-13660 Cross-site Scripting vulnerability in Cmsmadesimple CMS Made Simple
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. 		3.5
3.5
2019-06-05 CVE-2019-11226 Cross-site Scripting vulnerability in Cmsmadesimple CMS Made Simple 2.2.10
CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News. 		3.5
3.5
2019-04-25 CVE-2019-11513 Cross-site Scripting vulnerability in Cmsmadesimple CMS Made Simple
The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the "New name" field in a Rename action. 		3.5
3.5
2019-03-26 CVE-2019-10107 Cross-site Scripting vulnerability in Cmsmadesimple CMS Made Simple 2.2.10
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences -> My Account" section. 		3.5
3.5
2019-03-26 CVE-2019-10106 Cross-site Scripting vulnerability in Cmsmadesimple CMS Made Simple 2.2.10
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section. 		3.5
3.5
2019-03-26 CVE-2019-10105 Cross-site Scripting vulnerability in Cmsmadesimple CMS Made Simple 2.2.10
CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager "Name" field, which is reachable via a "Create a new Template" action to the Design Manager. 		3.5
3.5