CMS Made Simple < 2.2.15 Multiple XSS Vulnerabilities

CMS Made Simple is prone to multiple cross-site scripting (XSS) vulnerabilities.

The following vulnerabilities exist: - CVE-2020-36408: XSS in the 'Add Shortcut' parameter under the 'Manage Shortcuts' module - CVE-2020-36409: XSS in the 'Add Category' parameter under the 'Categories' module - CVE-2020-36410: XSS in the 'Email address to receive notification of news submission' parameter under the 'Options' module - CVE-2020-36411: XSS in the 'Path for the {page_image} tag:' or 'Path for thumbnail field:' parameters under the 'Content Editing Settings' module - CVE-2020-36412: XSS in the 'Search Text' field under the 'Admin Search' module - CVE-2020-36413: XSS in the 'Exclude these IP addresses from the 'Site Down' status' parameter under the 'Maintenance Mode' module - CVE-2020-36414: XSS in the 'Extra' fields under the 'Add Article' feature - CVE-2020-36415: XSS in the 'Create a new Stylesheet' parameter under the 'Stylesheets' module - CVE-2020-36416: XSS in the 'Create a new Design' parameter under the 'Designs' module

CMS Made Simple through version 2.2.14.

Checks if a vulnerable version is present on the target host.

Update to version 2.2.15 or later.