What’s Vulnerable › Vulnerabilities

CVE-2019-9692

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 45.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-03-11 · updated 2026-06-17
• Weakness: CWE-434

Description

class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).

Affected products

• CMS Made Simple: before 2.2.10 — fixed in 2.2.10

How to fix

Upgrade to a fixed version: CMS Made Simple 2.2.10. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html
• http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php&rev=47
• http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce
• https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285
• https://www.exploit-db.com/exploits/46546/
• https://www.exploit-db.com/exploits/46627/
• http://packetstormsecurity.com/files/152269/CMS-Made-Simple-CMSMS-Showtime2-File-Upload-Remote-Command-Execution.html
• http://viewsvn.cmsmadesimple.org/diff.php?repname=showtime2&path=%2Ftrunk%2Flib%2Fclass.showtime2_image.php&rev=47
• http://www.rapid7.com/db/modules/exploit/multi/http/cmsms_showtime2_rce
• https://forum.cmsmadesimple.org/viewtopic.php?f=1&t=80285
• https://www.exploit-db.com/exploits/46546/
• https://www.exploit-db.com/exploits/46627/

Get alerted when CVE-2019-9692 or the next vulnerability affects your stack