CVE-2018-10081

CRITICAL

CMS Made Simple < 2.2.7 - Admin Password Reset via Weak Hash Comparison

Title source: llm

Description

CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring.

References (1)

Core 1

Core References

Exploit, Technical Description, Third Party Advisory x_refsource_misc

https://github.com/itodaro/cve/blob/master/README.md

View Exploit ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0159

EPSS Percentile 72.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-640

Status published

Products (1)

cmsmadesimple/cms_made_simple < 2.2.7

Published Apr 13, 2018

Tracked Since Feb 18, 2026