Reflected Cross-Site Scripting in CMS Made Simple by CMS Made Simple

CVE-2022-23907

Summary

CMS Made Simple version 2.2.15 is impacted by a reflected cross-site scripting (XSS) vulnerability through the 'm1_fmmessage' parameter. This issue allows an attacker to inject malicious scripts into the web application which can be executed in the context of an unsuspecting user's session. This vulnerability can potentially lead to data theft, session hijacking, or other exploit scenarios, emphasizing the importance of securely handling user input and validating parameter data to prevent such attacks.

References