CVE-2016-2784

CMS Made Simple 2.x before 2.1.3 and 1.x before 1.12.2, when Smarty Cache is activated, allow remote attackers to conduct cache poisoning attacks, modify links, and conduct cross-site scripting (XSS) attacks via a crafted HTTP Host header in a request.

CVSS v3.0

4.7 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

2.6 LOWAV:N/AC:H/Au:N/C:N/I:P/A:N

EPSS

2.45% chance of exploitation in the next 30 days, 83th percentile

Published

2016-05-26

Updated

2024-08-05

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/39760

References

• CVE Record
• NVD entry

Related

• CVE-2016-2782
• CVE-2016-2819
• CVE-2016-2776
• CVE-2016-2851
• CVE-2016-2569
• CVE-2016-2853