Cmsmadesimple vulnerabilities
We track 4 vulnerabilities in Cmsmadesimple products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2025.
Latest Cmsmadesimple vulnerabilities
- 7.2 High severity
File Manager: Unrestricted Upload of File with Dangerous Type
An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manager v2.2.22 allows attackers with Administrator privileges to execute arbitrary code via uploading a crafted PHP file.
- 8.8 High severity
CMS Made Simple: Unrestricted Upload of File with Dangerous Type
Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell.
- 7.2 High severity
cms_made_simple: Failure to Sanitize Special Elements into a Different Plane
A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result
- 7.2 High severity
CMS Made Simple: Unrestricted Upload of File with Dangerous Type
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file.