CVE-2018-1000094

7.2 highEPSS 39%

CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.

Severity

CVSS 3.0

7.2 high

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 39% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2018-03-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cmsmadesimple:cms_made_simple

References

http://dev.cmsmadesimple.org/bug/view/11741
https://www.exploit-db.com/exploits/44976/
http://dev.cmsmadesimple.org/bug/view/11741
https://www.exploit-db.com/exploits/44976/

Check your stack JSON