Cmsmadesimple vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-63678 An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with AdministHigh 7.2 · Nov 10, 2025
• CVE-2024-27622 A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21.High 7.2 · Mar 5, 2024
• CVE-2023-43352 An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component.High 7.8 · Oct 26, 2023
• CVE-2023-36969 CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.High 8.8 · Jul 6, 2023
• CVE-2021-28999 SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/High 8.8 · May 8, 2023
• CVE-2021-28998 File upload vulnerability in CMS Made Simple through 2.2.15 allows remote authenticated attackers to gain a webshell via a crafted phar file.High 7.2 · May 8, 2023
• CVE-2021-40961 CMS Made Simple <=2.2.15 is affected by SQL injection in modules/News/function.admin_articlestab.php.High 8.8 · Jun 9, 2022
• CVE-2022-23906 CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function.High 7.2 · Feb 28, 2022
• CVE-2019-9060 An issue was discovered in CMS Made Simple 2.2.8.High 7.5 · Sep 17, 2021
• CVE-2020-17462 CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CVE-2017-16798.High 7.8 · Aug 14, 2020
• CVE-2020-10682 The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php.High 7.8 · Mar 20, 2020
• CVE-2019-9056 An issue was discovered in CMS Made Simple 2.2.8.High 8.8 · Apr 11, 2019
• CVE-2019-9061 An issue was discovered in CMS Made Simple 2.2.8.High 8.8 · Mar 26, 2019
• CVE-2019-9059 An issue was discovered in CMS Made Simple 2.2.8.High 7.2 · Mar 26, 2019
• CVE-2019-9058 An issue was discovered in CMS Made Simple 2.2.8.High 7.2 · Mar 26, 2019
• CVE-2019-9057 An issue was discovered in CMS Made Simple 2.2.8.High 8.8 · Mar 26, 2019
• CVE-2019-9055 An issue was discovered in CMS Made Simple 2.2.8.High 8.8 · Mar 26, 2019
• CVE-2019-9053 An issue was discovered in CMS Made Simple 2.2.8.High 8.1 · Mar 26, 2019
• CVE-2019-9693 In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter sHigh 8.8 · Mar 11, 2019
• CVE-2018-10519 CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalation vulnerability from ordinary user to admin user by arranging for the eff_uid value within $_COOKIE[High 8.8 · Apr 27, 2018
• CVE-2018-10517 In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by anHigh 7.2 · Apr 27, 2018
• CVE-2018-10515 In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an adHigh 7.2 · Apr 27, 2018
• CVE-2018-1000158 cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] .High 8.8 · Apr 18, 2018
• CVE-2018-10086 CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function High 7.2 · Apr 13, 2018
• CVE-2018-10085 CMS Made Simple (CMSMS) through 2.2.6 allows PHP object injection because of an unserialize call in the _get_data function of \lib\classes\internal\class.LoginOCritical 9.8 · Apr 13, 2018