CVE-2017-11404: In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a FileMana...

Security readout for executives and security teams

CMS Made Simple 2.2.2 allowed a remote authenticated administrator to upload a PHP file through FileManager. In business terms, a misused or compromised admin account could turn site administration access into server-side code placement. The source bundle does not identify active exploitation, CVSS severity, or fixed versions. Exposure is most likely on public or internal websites still running CMS Made Simple 2.2.2 with administrator access to FileManager. Risk depends heavily on admin account security and whether uploaded PHP can execute on the server. Prioritize if CMSMS 2.2.2 is internet-facing or admin credentials may be weak, shared, or exposed. Otherwise, handle as a legacy CMS hardening item during vulnerability remediation. Mitigation focus: Identify any CMS Made Simple 2.2.2 installations.; Check CMS Made Simple vendor guidance for fixed versions or configuration changes.; Upgrade affected CMSMS instances according to vendor instructions..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.