CVE-2019-11226

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

CMS Made Simple 2.2.10 has XSS via the m1_name parameter in "Add Article" under Content -> Content Manager -> News.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/May/36Exploit, Mailing List, Third Party Advisory
https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226Third Party Advisory
http://packetstormsecurity.com/files/153071/CMS-Made-Simple-2.2.10-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/May/36Exploit, Mailing List, Third Party Advisory
https://vulmon.com/vulnerabilitydetails?qid=CVE-2019-11226Third Party Advisory

Timeline

Published: Jun 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-112287.5repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.CVE-2019-112298.8models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.CVE-2019-11238.8A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V CVE-2019-112304.4In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log f CVE-2019-112319.8An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files wit CVE-2019-112329.8EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information (Password) without being authenticated, by sending an EMP_N CVE-2019-112337.5EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated, by sending a LOGIN_ID element CVE-2019-112349.8FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2 CVE-2019-112359.8FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group e CVE-2019-112366.1In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.CVE-2019-11248.8A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution V CVE-2019-112428.1A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity