CVE-2024-1527

8.8 highEPSS 0.9%

High (8.8) in cmsmadesimple cms made simple. EPSS 0.9% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2024-03-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cmsmadesimple:cms_made_simple

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cms-made-simple
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cms-made-simple

Check your stack JSON