CVE-2020-10681

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.13

Description The issue concerns a stored XSS vulnerability in the Filemanager component. This can be exploited via a .pxd file, as shown by sending m1 files[] to the "admin/moduleinterface.php" endpoint.

Recommendations For CMS Made Simple version 2.2.13, consider disabling the Filemanager component until a patch is available to prevent potential exploitation. Restrict access to the "admin/moduleinterface.php" endpoint to minimize the risk of stored XSS attacks. Avoid using the m1 files[] variable in the affected endpoint until the issue is resolved.