CVE-2024-27622

A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result, authenticated users with administrative privileges can inject and execute arbitrary PHP code.

• CWE-75
• CWE-94

• https://github.com/capture0x/CMSMadeSimple/Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/177241/CMS-Made-Simple-2.2.19-Remote-Code-Execution.htmlExploit, VDB Entry
• https://github.com/capture0x/CMSMadeSimple/Exploit, Third Party Advisory
• https://packetstormsecurity.com/files/177241/CMS-Made-Simple-2.2.19-Remote-Code-Execution.htmlExploit, VDB Entry
• https://www.vicarius.io/vsociety/posts/pwning-cmsms-via-user-defined-tags-for-fun-and-learning-cve-2024-27622-27623Exploit, Third Party Advisory

Published

Mar 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2761The Genesis Blocks WordPress plugin before 3.1.3 does not pr…6.8
• CVE-2024-27612Numbas editor before 7.3 mishandles editing of themes and ex…6.2
• CVE-2024-27613Numbas editor before 7.3 mishandles reading of themes and ex…7.3
• CVE-2024-27619Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer …7.3
• CVE-2024-2762The FooGallery WordPress plugin before 2.4.15, foogallery-p…5.4
• CVE-2024-27620An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote att…7.5
• CVE-2024-27623CMS Made Simple version 2.2.19 is vulnerable to Server-Side …5.9
• CVE-2024-27625CMS Made Simple Version 2.2.19 is vulnerable to Cross Site S…4.8
• CVE-2024-27626A Reflected Cross-Site Scripting (XSS) vulnerability has bee…6.1
• CVE-2024-27627A reflected cross-site scripting (XSS) vulnerability exists …6.1
• CVE-2024-27628Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an att…8.1
• CVE-2024-27629An issue in dc2niix before v.1.0.20240202 allows a local att…7.8