CVE-2026-4225

A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Management Module. Performing a manipulation of the argument Message results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

CVSS v3 2.4 LOW
CVSS v2.0 3.3 LOW

2.4^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:L/Au:M/C:N/I:P/A:N

Exploitability : 6.4 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/feixuezhi/cms/wiki
https://vuldb.com/?ctiid.351148
https://vuldb.com/?id.351148
https://vuldb.com/?submit.770530

Configurations

No configuration.

History

22 Apr 2026, 21:32

Type	Values Removed	Values Added
Summary		(es) Una falla de seguridad ha sido descubierta en CMS Made Simple hasta la versión 2.2.21. Afecta a una función desconocida del archivo admin/listusers.php del componente Módulo de Gestión de Usuarios. Realizar una manipulación del argumento Message resulta en cross-site scripting. El ataque puede ser llevado a cabo de forma remota. El exploit ha sido publicado y puede ser utilizado para ataques.

16 Mar 2026, 14:20

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-16 14:20

Updated : 2026-06-17 10:56

NVD link : CVE-2026-4225

Mitre link : CVE-2026-4225

CVE.ORG link : CVE-2026-4225

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-4225", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4225", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T17:15:33.711154Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N", "authentication": "MULTIPLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.9}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:cms_made_simple:cms_made_simple:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["User Management Module"], "product": "CMS Made Simple", "versions": [{"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "2.2.4"}, {"status": "affected", "version": "2.2.5"}, {"status": "affected", "version": "2.2.6"}, {"status": "affected", "version": "2.2.7"}, {"status": "affected", "version": "2.2.8"}, {"status": "affected", "version": "2.2.9"}, {"status": "affected", "version": "2.2.10"}, {"status": "affected", "version": "2.2.11"}, {"status": "affected", "version": "2.2.12"}, {"status": "affected", "version": "2.2.13"}, {"status": "affected", "version": "2.2.14"}, {"status": "affected", "version": "2.2.15"}, {"status": "affected", "version": "2.2.16"}, {"status": "affected", "version": "2.2.17"}, {"status": "affected", "version": "2.2.18"}, {"status": "affected", "version": "2.2.19"}, {"status": "affected", "version": "2.2.20"}, {"status": "affected", "version": "2.2.21"}]}]}], "published": "2026-03-16T14:20:15.227", "references": [{"url": "https://github.com/feixuezhi/cms/wiki", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.351148", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.351148", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.770530", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Management Module. Performing a manipulation of the argument Message results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en CMS Made Simple hasta la versi\u00f3n 2.2.21. Afecta a una funci\u00f3n desconocida del archivo admin/listusers.php del componente M\u00f3dulo de Gesti\u00f3n de Usuarios. Realizar una manipulaci\u00f3n del argumento Message resulta en cross-site scripting. El ataque puede ser llevado a cabo de forma remota. El exploit ha sido publicado y puede ser utilizado para ataques."}], "lastModified": "2026-06-17T10:56:15.440", "sourceIdentifier": "cna@vuldb.com"}