What’s Vulnerable › Vulnerabilities

CVE-2024-1527: Unrestricted Upload of File with Dangerous Type in CMS Made Simple

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-12 · updated 2026-06-17
• Weakness: CWE-434

Description

Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypass the security measures of the upload functionality and potentially create a remote execution of commands via webshell.

Affected products

• CMS Made Simple: 2.2.14

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cms-made-simple
• https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-cms-made-simple

Get alerted when CVE-2024-1527 or the next vulnerability affects your stack