VULNERABILITY INTELLIGENCE

CVE-2018-10086

CVSS score7.2 HIGH
EPSS probability1.89%
CISA KEVNot currently listed
Published2018-04-13
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references