CVE-2018-10517

In CMS Made Simple (CMSMS) through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element.

• CWE-94

• https://github.com/itodaro/cmsms_cve/blob/master/README.mdExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/45793/Exploit, Third Party Advisory, VDB Entry
• https://github.com/itodaro/cmsms_cve/blob/master/README.mdExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/45793/Exploit, Third Party Advisory, VDB Entry

Published

Apr 27, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10511A vulnerability in Trend Micro Control Manager (versions 6.0…10
• CVE-2018-10512A vulnerability in Trend Micro Control Manager (versions 6.0…
• CVE-2018-10513A Deserialization of Untrusted Data Privilege Escalation vul…
• CVE-2018-10514A Missing Impersonation Privilege Escalation vulnerability i…
• CVE-2018-10515In CMS Made Simple (CMSMS) through 2.2.7, the "file unpack" …
• CVE-2018-10516In CMS Made Simple (CMSMS) through 2.2.7, the "file rename" …
• CVE-2018-10518In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" …
• CVE-2018-10519CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalatio…
• CVE-2018-1052Memory disclosure vulnerability in table partitioning was fo…
• CVE-2018-10520In CMS Made Simple (CMSMS) through 2.2.7, the "module remove…
• CVE-2018-10521In CMS Made Simple (CMSMS) through 2.2.7, the "file move" op…
• CVE-2018-10522In CMS Made Simple (CMSMS) through 2.2.7, the "file view" op…