What’s Vulnerable › Vulnerabilities

CVE-2020-37238: CMS Made Simple 2.2.15 Stored XSS via SVG File Upload

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-16 · updated 2026-09-29
• Weakness: CWE-79

Description

CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scripts through SVG file uploads. Attackers can upload SVG files containing embedded JavaScript to the file manager, which executes when other authenticated users access the uploaded file, enabling cookie theft and session hijacking.

Affected products

• CMS Made Simple: 2.2.15

References

• https://www.cmsmadesimple.org/
• https://www.cmsmadesimple.org/downloads
• https://www.exploit-db.com/exploits/49199
• https://www.vulncheck.com/advisories/cms-made-simple-stored-xss-via-svg-file-upload

Get alerted when CVE-2020-37238 or the next vulnerability affects your stack