CVE-2019-9053

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

68.58%

Published

Mar 26, 2019

Modified

Nov 17, 2025

Public PoC / Exploit (2)

All weaponized →

Exploit-DBCMS Made Simple < 2.2.10 - SQL Injection TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.

Weaknesses (CWE)

CWE-89

Affected Products (1)

cmsmadesimple · cms_made_simplevulnerable

References (9)

http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html

ExploitThird Party AdvisoryVDB Entry

https://github.com/Perseus99999/CVE-2019-9053-working-/blob/main/exploit.py

https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg

Release NotesVendor Advisory

https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum

Release NotesVendor Advisory

https://www.exploit-db.com/exploits/46635/

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html

ExploitThird Party AdvisoryVDB Entry

https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg

Release NotesVendor Advisory

https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum

Release NotesVendor Advisory

https://www.exploit-db.com/exploits/46635/

ExploitThird Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs