CVE-2012-1992

CMS Made Simple < 1.10.3 - Cross-Site Scripting via Email Parameter

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter (aka the Email Address field in the Edit User template).

References (2)

Core 2

Core References

Various Sources x_refsource_misc

http://www.webapp-security.com/wp-content/uploads/2012/04/CMS-Made-Simple-1.10.3-XSS-Vulnerability2.txt

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/52850

Scores

EPSS 0.0032

EPSS Percentile 54.9%

Details

CWE

CWE-79

Status published

Products (37)

cmsmadesimple/cms_made_simple 0.1

cmsmadesimple/cms_made_simple 0.2

cmsmadesimple/cms_made_simple 0.2.1

cmsmadesimple/cms_made_simple 0.3

cmsmadesimple/cms_made_simple 0.3.1

cmsmadesimple/cms_made_simple 0.3.2

cmsmadesimple/cms_made_simple 0.4

cmsmadesimple/cms_made_simple 0.4.1

cmsmadesimple/cms_made_simple 0.5

cmsmadesimple/cms_made_simple 0.5.1

... and 27 more

Published Apr 11, 2012

Tracked Since Feb 18, 2026