CVE-2010-2797
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8...
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
- Record
CVE-2010-2797- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
- Record
CVE-2010-2797- Updated
- 2026-11-02
EUVDEUVD-2010-2801 No score
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
- Record
EUVD-2010-2801- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qhfr-jgqp-74cp No score
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8...
Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the default_cms_lang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.
- Record
GHSA-qhfr-jgqp-74cp- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-2797 is a high vulnerability (CVSS 7.5) in Cmsmadesimple Cms Made Simple, published October 8, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.69%, the 94th percentile. No source names a fixed version.
References
cmsmadesimple.org/2010/07/3/announcing-cms-made-simple-1-8-1-mankara
openwall.com/lists/oss-security/2010/08/01/2
secunia.com/advisories/40031
cross-site-scripting.blogspot.com/2010/07/cms-made-simple-18-local-file-inclusion.html
nvd.nist.gov/vuln/detail/CVE-2010-2797
github.com/advisories/GHSA-qhfr-jgqp-74cp