CVE-2018-10522

In CMS Made Simple (CMSMS) through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP file_get_contents function.

• CWE-200

• https://github.com/itodaro/cmsms_cve/blob/master/README.mdExploit, Technical Description, Third Party Advisory
• https://github.com/itodaro/cmsms_cve/blob/master/README.mdExploit, Technical Description, Third Party Advisory

Published

Apr 27, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10517In CMS Made Simple (CMSMS) through 2.2.7, the "module import…
• CVE-2018-10518In CMS Made Simple (CMSMS) through 2.2.7, the "file delete" …
• CVE-2018-10519CMS Made Simple (CMSMS) 2.2.7 contains a privilege escalatio…
• CVE-2018-1052Memory disclosure vulnerability in table partitioning was fo…
• CVE-2018-10520In CMS Made Simple (CMSMS) through 2.2.7, the "module remove…
• CVE-2018-10521In CMS Made Simple (CMSMS) through 2.2.7, the "file move" op…
• CVE-2018-10523CMS Made Simple (CMSMS) through 2.2.7 contains a physical pa…
• CVE-2018-10527EasyCMS 1.3 is prone to Stored XSS when posting an article; …
• CVE-2018-10528An issue was discovered in LibRaw 0.18.9. There is a stack-b…8.8
• CVE-2018-10529An issue was discovered in LibRaw 0.18.9. There is an out-of…
• CVE-2018-1053In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.…
• CVE-2018-10531An issue was discovered in the America's Army Proving Ground…7.5