CVE-2008-2267

no score yetEPSS 4.8%

cms made simple cms made simple: no CVSS score yet. EPSS 4.8% chance of exploitation in the next 30 days.

Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.

EPSS: 4.8% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2008-05-16
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

cms_made_simple:cms_made_simple

References

http://blog.cmsmadesimple.org/2008/05/12/announcing-cms-made-simple-125/
http://secunia.com/advisories/30208
http://www.attrition.org/pipermail/vim/2008-May/001978.html
http://www.securityfocus.com/bid/29170
https://exchange.xforce.ibmcloud.com/vulnerabilities/42371

Check your stack JSON