CVE-2026-4225

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4225", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-15T18:36:51.235Z", "datePublished": "2026-03-16T07:32:07.692Z", "dateUpdated": "2026-03-16T17:15:48.555Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T07:32:07.692Z"}, "title": "CMS Made Simple User Management listusers.php cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "n/a", "product": "CMS Made Simple", "versions": [{"version": "2.2.0", "status": "affected"}, {"version": "2.2.1", "status": "affected"}, {"version": "2.2.2", "status": "affected"}, {"version": "2.2.3", "status": "affected"}, {"version": "2.2.4", "status": "affected"}, {"version": "2.2.5", "status": "affected"}, {"version": "2.2.6", "status": "affected"}, {"version": "2.2.7", "status": "affected"}, {"version": "2.2.8", "status": "affected"}, {"version": "2.2.9", "status": "affected"}, {"version": "2.2.10", "status": "affected"}, {"version": "2.2.11", "status": "affected"}, {"version": "2.2.12", "status": "affected"}, {"version": "2.2.13", "status": "affected"}, {"version": "2.2.14", "status": "affected"}, {"version": "2.2.15", "status": "affected"}, {"version": "2.2.16", "status": "affected"}, {"version": "2.2.17", "status": "affected"}, {"version": "2.2.18", "status": "affected"}, {"version": "2.2.19", "status": "affected"}, {"version": "2.2.20", "status": "affected"}, {"version": "2.2.21", "status": "affected"}], "cpes": ["cpe:2.3:a:cms_made_simple:cms_made_simple:*:*:*:*:*:*:*:*"], "modules": ["User Management Module"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Management Module. Performing a manipulation of the argument Message results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-03-15T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-15T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-15T19:41:55.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "feioklucy (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.351148", "name": "VDB-351148 | CMS Made Simple User Management listusers.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351148", "name": "VDB-351148 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.770530", "name": "Submit #770530 | cms made simple 2.2.21 XSS", "tags": ["third-party-advisory"]}, {"url": "https://github.com/feixuezhi/cms/wiki", "tags": ["exploit"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T17:15:33.711154Z", "id": "CVE-2026-4225", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T17:15:48.555Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4225", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T17:15:33.711154Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T17:15:38.640Z"}}], "cna": {"tags": ["x_open-source"], "title": "CMS Made Simple User Management listusers.php cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "feioklucy (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.4, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:cms_made_simple:cms_made_simple:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["User Management Module"], "product": "CMS Made Simple", "versions": [{"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "2.2.4"}, {"status": "affected", "version": "2.2.5"}, {"status": "affected", "version": "2.2.6"}, {"status": "affected", "version": "2.2.7"}, {"status": "affected", "version": "2.2.8"}, {"status": "affected", "version": "2.2.9"}, {"status": "affected", "version": "2.2.10"}, {"status": "affected", "version": "2.2.11"}, {"status": "affected", "version": "2.2.12"}, {"status": "affected", "version": "2.2.13"}, {"status": "affected", "version": "2.2.14"}, {"status": "affected", "version": "2.2.15"}, {"status": "affected", "version": "2.2.16"}, {"status": "affected", "version": "2.2.17"}, {"status": "affected", "version": "2.2.18"}, {"status": "affected", "version": "2.2.19"}, {"status": "affected", "version": "2.2.20"}, {"status": "affected", "version": "2.2.21"}]}], "timeline": [{"lang": "en", "time": "2026-03-15T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-15T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-15T19:41:55.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351148", "name": "VDB-351148 | CMS Made Simple User Management listusers.php cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351148", "name": "VDB-351148 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.770530", "name": "Submit #770530 | cms made simple 2.2.21 XSS", "tags": ["third-party-advisory"]}, {"url": "https://github.com/feixuezhi/cms/wiki", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Management Module. Performing a manipulation of the argument Message results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-16T07:32:07.692Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4225", "state": "PUBLISHED", "dateUpdated": "2026-03-16T17:15:48.555Z", "dateReserved": "2026-03-15T18:36:51.235Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-16T07:32:07.692Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:cms_made_simple:cms_made_simple:*:*:*:*:*:*:*:*"], "modules": ["User Management Module"], "product": "CMS Made Simple", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.2.0"}, {"status": "affected", "version": "2.2.1"}, {"status": "affected", "version": "2.2.2"}, {"status": "affected", "version": "2.2.3"}, {"status": "affected", "version": "2.2.4"}, {"status": "affected", "version": "2.2.5"}, {"status": "affected", "version": "2.2.6"}, {"status": "affected", "version": "2.2.7"}, {"status": "affected", "version": "2.2.8"}, {"status": "affected", "version": "2.2.9"}, {"status": "affected", "version": "2.2.10"}, {"status": "affected", "version": "2.2.11"}, {"status": "affected", "version": "2.2.12"}, {"status": "affected", "version": "2.2.13"}, {"status": "affected", "version": "2.2.14"}, {"status": "affected", "version": "2.2.15"}, {"status": "affected", "version": "2.2.16"}, {"status": "affected", "version": "2.2.17"}, {"status": "affected", "version": "2.2.18"}, {"status": "affected", "version": "2.2.19"}, {"status": "affected", "version": "2.2.20"}, {"status": "affected", "version": "2.2.21"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Management Module. Performing a manipulation of the argument Message results in cross site scripting. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en CMS Made Simple hasta la versi\u00f3n 2.2.21. Afecta a una funci\u00f3n desconocida del archivo admin/listusers.php del componente M\u00f3dulo de Gesti\u00f3n de Usuarios. Realizar una manipulaci\u00f3n del argumento Message resulta en cross-site scripting. El ataque puede ser llevado a cabo de forma remota. El exploit ha sido publicado y puede ser utilizado para ataques."}], "id": "CVE-2026-4225", "lastModified": "2026-06-17T10:56:15.440", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.4, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4225", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T17:15:33.711154Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:20:15.227", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/feixuezhi/cms/wiki"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.351148"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.351148"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.770530"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,2.2.21]"}}], "enrichment": {"confidence": 90.0, "confidence_source": "inferred", "scores": [{"score": 90.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CMS Made Simple", "source": "cna", "vendor": "n/a"}, "product": "cms_made_simple", "vendor": "cms_made_simple"}], "analysis": {"en": {"generated_at": "2026-03-17T11:41:27.161391+00:00", "value": {"mitigation_remediation": ["Upgrade CMS Made Simple to a version newer than 2.2.21, or apply any vendor-provided patch that addresses the XSS issue.", "If an immediate upgrade is not possible, restrict access to admin/listusers.php to privileged users only and validate or sanitize the Message input parameter to remove script content.", "Disable or remove the User Management Module until a secure version is available."], "summary": {"action": "Patch ASAP", "impact": "Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "CMS Made Simple versions up to and including 2.2.21 are affected. The flaw resides in admin/listusers.php and can be triggered by manipulating the Message parameter.", "description_and_impact": "The vulnerability in CMS Made Simple allows an attacker to inject malicious scripts through the Message argument in admin/listusers.php of the User Management Module. This cross\u2011site scripting flaw can execute arbitrary JavaScript in the browsers of users who view the content, enabling cookie theft, session hijacking, site defacement, or the delivery of additional payloads. The flaw is classified as CWE-79.", "risk_and_exploitability": "The CVSS score of 4.8 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV and the exploit code is publicly available. Attackers can remotely exploit the flaw by sending a crafted Message parameter to an authenticated or unauthenticated user who views the affected page."}}}}, "created": "2026-03-17T09:53:03.728560+00:00", "updated": "2026-03-24T10:45:27.263492+00:00", "vendors": ["cms_made_simple", "cms_made_simple$PRODUCT$cms_made_simple"]}