CVE-2024-27625

CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field.

• CWE-79

• https://packetstormsecurity.com/files/177243/CMS-Made-Simple-2.2.19-Cross-Site-Scripting.htmlExploit, VDB Entry
• https://packetstormsecurity.com/files/177243/CMS-Made-Simple-2.2.19-Cross-Site-Scripting.htmlExploit, VDB Entry

Published

Mar 5, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27613Numbas editor before 7.3 mishandles reading of themes and ex…7.3
• CVE-2024-27619Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer …7.3
• CVE-2024-2762The FooGallery WordPress plugin before 2.4.15, foogallery-p…5.4
• CVE-2024-27620An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote att…7.5
• CVE-2024-27622A remote code execution vulnerability has been identified in…7.2
• CVE-2024-27623CMS Made Simple version 2.2.19 is vulnerable to Server-Side …5.9
• CVE-2024-27626A Reflected Cross-Site Scripting (XSS) vulnerability has bee…6.1
• CVE-2024-27627A reflected cross-site scripting (XSS) vulnerability exists …6.1
• CVE-2024-27628Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an att…8.1
• CVE-2024-27629An issue in dc2niix before v.1.0.20240202 allows a local att…7.8
• CVE-2024-2763A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-27630Insecure Direct Object Reference (IDOR) in GNU Savane v.3.12…7.5