CVE-2016-2784 EXPLOIT
4.7
MEDIUM · CVSS 3.0 · EPSS 2.5% (pctl 84)
Patch early
A public exploit exists.
Description
CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.
Scoring
| CVSS | 4.7 (MEDIUM, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 2.45% — more likely to be exploited than 84% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2016-05-26 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| cmsmadesimple | cms made simple |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | CMS Made Simple < 1.12.1 / < 2.1.3 - Web Server Cache Poisoning | 2016-05-04 |
References
- http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html
- http://seclists.org/fulldisclosure/2016/May/15
- http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/
- http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point/
- http://www.securityfocus.com/archive/1/538272/100/0/threaded
- https://www.exploit-db.com/exploits/39760/
- http://packetstormsecurity.com/files/136897/CMS-Made-Simple-Cache-Poisoning.html
- http://seclists.org/fulldisclosure/2016/May/15
- http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia/
- http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point/
- http://www.securityfocus.com/archive/1/538272/100/0/threaded
- https://www.exploit-db.com/exploits/39760/
→ the Explorer · watch your stack · NVD