CMS Made Simple 2.2.7
Approved changes feed: RSS · Atom
cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.7:*:*:*:*:*:*:*
part: a version: 2.2.7 update: *
| Vendor | Cmsmadesimple (8ed73986-e506-5acb-a027-f2d81aed9376) |
|---|---|
| Product | Cms Made Simple (3c989cef-25f4-5ecb-b903-28c284166358) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:cmsmadesimple/cmsmadesimple |
purl2cpe | 2026-06-01 10:12:04.294453 |
pkg:github/cmsmadesimple/cmsmadesimple-2-0 |
purl2cpe | 2026-06-01 10:12:04.294454 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-9921 |
vulnerable | 2026-06-08 05:12:08.358963 |
Details available
In CMS Made Simple 2.2.7, a Directory Traversal issue makes it possible to determine the existence of files and directories outside the web-site installation directory, and determine whether a file has contents matching a specified checksum. The attack uses an admin/checksum.php?__c= request.
Published: 2018-04-23T18:00:00.000Z
Updated: 2024-08-05T07:24:56.301Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18271 |
vulnerable | 2026-06-08 05:11:07.386315 |
Details available
XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
Published: 2018-10-12T19:00:00.000Z
Updated: 2024-09-17T00:45:37.181Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-18270 |
vulnerable | 2026-06-08 05:11:07.385910 |
Details available
XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php "Content-->News-->Add Article" action.
Published: 2018-10-12T19:00:00.000Z
Updated: 2024-09-16T19:35:22.600Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-10519 |
vulnerable | 2026-06-08 05:10:26.768778 |
Details available
CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[$this->_loginkey] to equal 1, because files in the tmp/ directory are accessible through HTTP requests. NOTE: this vulnerability exists because of an incorrect fix for CVE-2018-10084.
Published: 2018-04-27T18:00:00.000Z
Updated: 2024-09-16T20:47:50.154Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1000158 |
vulnerable | 2026-06-08 05:10:25.552355 |
Details available
cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack.
Published: 2018-04-18T19:00:00.000Z
Updated: 2024-08-05T12:33:49.474Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.