CVE-2018-10029

MEDIUM

CMS Made Simple < 2.2.7 - Reflected Cross-Site Scripting via m1_name Parameter

Title source: llm

Description

CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799.

References (1)

Core 1

Core References

Exploit, Technical Description, Third Party Advisory x_refsource_misc

https://github.com/zxyxx/cmsms_vul

Scores

CVSS v3 4.8

EPSS 0.0022

EPSS Percentile 43.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

cmsmadesimple/cms_made_simple < 2.2.7

Published Apr 11, 2018

Tracked Since Feb 18, 2026