{"api_version":"1","generated_at":"2026-07-23T10:02:05+00:00","cve":"CVE-2018-10520","urls":{"html":"https://cve.report/CVE-2018-10520","api":"https://cve.report/api/cve/CVE-2018-10520.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-10520","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-10520"},"summary":{"title":"CVE-2018-10520","description":"In CMS Made Simple (CMSMS) through 2.2.7, the \"module remove\" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-04-27 18:29:00","updated_at":"2019-10-03 00:03:00"},"problem_types":["CWE-732"],"metrics":[],"references":[{"url":"https://github.com/itodaro/cmsms_cve/blob/master/README.md","name":"https://github.com/itodaro/cmsms_cve/blob/master/README.md","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"cmsms_cve/README.md at master · itodaro/cmsms_cve · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10520","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10520","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"10520","vulnerable":"1","versionEndIncluding":"2.2.7","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cmsmadesimple","cpe5":"cms_made_simple","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2018-10520","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In CMS Made Simple (CMSMS) through 2.2.7, the \"module remove\" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/itodaro/cmsms_cve/blob/master/README.md","refsource":"MISC","url":"https://github.com/itodaro/cmsms_cve/blob/master/README.md"}]}},"nvd":{"publishedDate":"2018-04-27 18:29:00","lastModifiedDate":"2019-10-03 00:03:00","problem_types":["CWE-732"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":1.2,"impactScore":5.2},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:C/A:C","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE","baseScore":8.5},"severity":"HIGH","exploitabilityScore":8,"impactScore":9.2,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*","versionEndIncluding":"2.2.7","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"10520","Ordinal":"126958","Title":"CVE-2018-10520","CVE":"CVE-2018-10520","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"10520","Ordinal":"1","NoteData":"In CMS Made Simple (CMSMS) through 2.2.7, the \"module remove\" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"10520","Ordinal":"2","NoteData":"2018-04-27","Type":"Other","Title":"Published"}]}}}