CVE-2019-11226

MEDIUM

CMS Made Simple 2.2.10 - Stored Cross-Site Scripting via m1_name Parameter

Title source: llm
STIX 2.1

Description

CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.

References (3)

Core 3
Core References
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/May/36
Third Party Advisory x_refsource_misc
https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226

Scores

CVSS v3 5.4
EPSS 0.0027
EPSS Percentile 50.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
cmsmadesimple/cms_made_simple 2.2.10
Published Jun 05, 2019
Tracked Since Feb 18, 2026