VULNERABILITY INTELLIGENCE

CVE-2018-10520

CVSS score6.5 MEDIUM
EPSS probability0.95%
CISA KEVNot currently listed
Published2018-04-27
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Description

In CMS Made Simple (CMSMS) through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.

Weakness classification

  • CWE-732: Incorrect Permission Assignment for Critical Resource

Primary references