CVE-2014-0334 in CMS Made Simple

Summary

Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple allow remote authenticated users to inject arbitrary web script or HTML via (1) the group parameter to admin/addgroup.php, (2) the htmlblob parameter to admin/addhtmlblob.php, the (3) title or (4) url parameter to admin/addbookmark.php, (5) the stylesheet_name parameter to admin/copystylesheet.php, (6) the template_name parameter to admin/copytemplate.php, the (7) title or (8) url parameter to admin/editbookmark.php, (9) the template parameter to admin/listtemplates.php, or (10) the css_name parameter to admin/listcss.php, a different issue than CVE-2014-2092.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Reservation: 12/05/2013
• Disclosure: 03/02/2014
• Moderation: VulDB entry created
• Entries: 1
• CPE: ready
• CWE: CWE-79 (Confirmed)
• Exploit: Download
• CVSS: 3.5
• EPSS: 0.00850
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2014-0334
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-0334
• CVE Details: https://www.cvedetails.com/cve/CVE-2014-0334/