CVE-2019-9057

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in CMS Made Simple 2.2.8. In the module FilePicker, it is possible to reach an unserialize call with an untrusted parameter, and achieve authenticated object injection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502 CWE-915

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwgRelease Notes, Vendor Advisory
https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-SpuzzumRelease Notes, Vendor Advisory
https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwgRelease Notes, Vendor Advisory
https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-SpuzzumRelease Notes, Vendor Advisory

Timeline

Published: Mar 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-90587.2An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted valu CVE-2019-90597.2An issue was discovered in CMS Made Simple 2.2.8. It is possible, with an administrator account, to achieve command injection by modifying t CVE-2019-90607.5An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExtensions module (in th CVE-2019-90618.8An issue was discovered in CMS Made Simple 2.2.8. In the module ModuleManager (in the file action.installmodule.php), it is possible to reac CVE-2019-90628.0PHP Scripts Mall Online Food Ordering Script 1.0 has Cross-Site Request Forgery (CSRF) in my-account.php.CVE-2019-90636.5PHP Scripts Mall Auction website script 2.0.4 allows parameter tampering of the payment amount.CVE-2019-90645.3PHP Scripts Mall Cab Booking Script 1.0.3 allows Directory Traversal into the parent directory of a jpg or png file.CVE-2019-90656.5PHP Scripts Mall Custom T-Shirt Ecommerce Script 3.1.1 allows parameter tampering of the payment amount.CVE-2019-90665.4PHP Scripts Mall PHP Appointment Booking Script 3.0.3 allows HTML injection in a user profile.CVE-2019-90707.8An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a heap-based buffer over-read in d_expression_1 in cp-d CVE-2019-90715.5An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption issue in d_count_templates_scopes i CVE-2019-90725.5An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. It is an attempted ex