CVE-2017-11405: In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators can upload a .php file via a CMSConte...

Security readout for executives and security teams

CVE-2017-11405 describes a way for a logged-in CMS Made Simple administrator to upload a PHP file through admin module actions. If abused, this could let an attacker with admin access place executable server-side code. The source evidence does not provide a CVSS score, confirmed patch, or active exploitation claim. Exposure appears limited to CMS Made Simple 2.2.2 instances where attackers already have, or can obtain, administrator access to the CMS admin interface and relevant module actions. The provided record does not establish broader affected versions or products. Treat this as high priority if CMSMS 2.2.2 is internet-facing or administrator accounts are broadly shared. The main business risk is post-authentication server compromise after an admin credential is misused. If no CMSMS 2.2.2 is present, priority drops sharply. Mitigation focus: Check CMS Made Simple vendor guidance for the corrected version or official workaround.; Restrict CMS administrator access to trusted users and trusted network paths.; Review admin roles and remove unnecessary content-management or file-upload privileges..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.