CMS Made Simple 2.2.8
Approved changes feed: RSS · Atom
cpe:2.3:a:cmsmadesimple:cms_made_simple:2.2.8:*:*:*:*:*:*:*
part: a version: 2.2.8 update: *
| Vendor | Cmsmadesimple (8ed73986-e506-5acb-a027-f2d81aed9376) |
|---|---|
| Product | Cms Made Simple (3c989cef-25f4-5ecb-b903-28c284166358) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:cmsmadesimple/cmsmadesimple |
purl2cpe | 2026-06-01 10:12:04.294456 |
pkg:github/cmsmadesimple/cmsmadesimple-2-0 |
purl2cpe | 2026-06-01 10:12:04.294457 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-9060 |
vulnerable | 2026-06-08 05:14:24.920484 |
Details available
An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in the file action.setdefaulttemplate.php) with the m1_filename parameter; and through the action.showmessage.php file, it is possible to read arbitrary file content (by using that path traversal with m1_prefname set to cg_errormsg and m1_resettodefault=1).
Published: 2021-09-17T15:47:53.000Z
Updated: 2024-08-04T21:38:46.228Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-9056 |
vulnerable | 2026-06-08 05:14:24.919027 |
Details available
An issue was discovered in CMS Made Simple 2.2.8. In the module FrontEndUsers (in the file class.FrontEndUsersManipulate.php or class.FrontEndUsersManipulator.php), it is possible to reach an unserialize call with an untrusted __FEU__ cookie, and achieve authenticated object injection.
Published: 2019-04-11T19:26:42.000Z
Updated: 2024-08-04T21:38:46.289Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-9053 |
vulnerable | 2026-06-08 05:14:24.916654 |
Details available
An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
Published: 2019-03-26T16:15:38.000Z
Updated: 2025-11-17T19:19:52.125Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-20464 |
vulnerable | 2026-06-08 05:11:27.273163 |
Details available
There is a reflected XSS vulnerability in the CMS Made Simple 2.2.8 admin/myaccount.php. This vulnerability is triggered upon an attempt to modify a user's mailbox with the wrong format. The response contains the user's previously entered email address.
Published: 2018-12-25T23:00:00.000Z
Updated: 2024-08-05T12:05:16.896Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19597 |
vulnerable | 2026-06-08 05:11:15.927156 |
Details available
CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798.
Published: 2018-12-19T19:00:00.000Z
Updated: 2024-08-05T11:37:11.565Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.