CVE-2017-6070: CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code...

Security readout for executives and security teams

This issue affects the Form Builder module used with CMS Made Simple 1.x. Versions before 0.8.1.6 may let a remote attacker execute PHP code through a form template parameter. Successful exploitation could let an attacker run code in the web application context. Public sources do not provide a CVSS score or confirmed exploitation evidence. Exposure is most likely on CMS Made Simple 1.x sites using the Form Builder module before 0.8.1.6. Prioritize internet-facing sites and any environment where the CMS admin surface is reachable. The supplied affected-product metadata is incomplete, so confirm locally installed module versions. Treat this as a high-priority legacy CMS risk if CMS Made Simple is present. Remote code execution can support site takeover, data theft, and pivoting. Urgency is lower where the product is absent, patched, or admin access is strongly restricted. Mitigation focus: Inventory CMS Made Simple 1.x sites and installed Form Builder module versions.; Upgrade Form Builder to version 0.8.1.6 or later where applicable.; Review the Daylight IT advisory and CMS Made Simple project files for vendor guidance..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.