{"id":"CVE-2018-1000094","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-1000094","generatedAt":"2026-10-28T21:34:44.150Z","title":"CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server.","description":"CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.","published":"2018-03-13T01:29:01.000Z","lastModified":"2026-06-17T01:32:25.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.0","score":7.2,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-434"],"affected":["cmsmadesimple/cms made simple"],"epss":{"score":0.38802,"percentile":0.9858,"date":"2026-10-27","history":[{"date":"2026-09-21","score":0.33335,"percentile":0.98339},{"date":"2026-09-22","score":0.38802,"percentile":0.9852}]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2018-07-04","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44976,"kind":"exploit","title":"CMS Made Simple 2.2.5 - (Authenticated) Remote Code Execution","url":"https://www.exploit-db.com/exploits/44976","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/44976.py","file":"exploits/php/webapps/44976.py","published":"2018-07-04","added":"2018-07-04","updated":"2018-09-11","author":"Mustafa Hasan","type":"webapps","platform":"php","port":null,"verified":true,"codes":["CVE-2018-1000094"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comcmsms-2.2.5-install.zip","screenshotUrl":"http://www.exploit-db.com/screenshots/idlt45000/44976-2.png","referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 38.8%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-09-22T00:00:00.000Z","detail":{"to":0.38802,"from":0.33335,"percentile":0.9852},"summary":"EPSS moved from 33.3% to 38.8% probability of exploitation in the next thirty days."}],"references":[{"url":"http://dev.cmsmadesimple.org/bug/view/11741","tags":["Exploit","Issue Tracking","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://www.exploit-db.com/exploits/44976/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://dev.cmsmadesimple.org/bug/view/11741","tags":["Exploit","Issue Tracking","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44976/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000094","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}