CVE-2024-27625

MEDIUM

CMS Made Simple 2.2.19 - Stored Cross-Site Scripting in File Manager New Directory Field

Title source: llm
STIX 2.1

Description

CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field.

References (1)

Core 1

Scores

CVSS v3 4.8
EPSS 0.0013
EPSS Percentile 31.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
cmsmadesimple/cms_made_simple 2.2.19
Published Mar 05, 2024
Tracked Since Feb 18, 2026