CVE-2018-1000092: CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin p...

Security readout for executives and security teams

CMS Made Simple 2.2.5 had a CSRF flaw on the admin profile page. If an administrator could be tricked into visiting a crafted page while authenticated, profile-related changes might be triggered without clear intent. The CVE says this was fixed in 2.2.6, but provides limited impact detail. Exposure is most likely limited to CMS Made Simple installations running version 2.2.5, especially where administrators use the admin profile page while browsing untrusted content. The source bundle does not identify broader affected versions. Treat this as a targeted administrative web-app risk, not a confirmed mass-exploitation emergency. Prioritize remediation for any internet-facing or business-critical CMS Made Simple 2.2.5 sites, especially where administrator accounts have broad publishing or configuration privileges. Mitigation focus: Upgrade CMS Made Simple 2.2.5 installations to 2.2.6 or later.; Check the linked vendor bug record for any additional vendor guidance.; Restrict administrative access to trusted users and networks where feasible..

Prepared

Jun 7, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.