{"id":"CVE-2017-6556","aliases":["EUVD-2017-15612","GHSA-xrwq-4gxw-wvh5"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote...","description":"Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the \"adminpage \u003e sitesetting \u003e General Settings \u003e globalmetadata\" field.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00607,"percentile":0.49328,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2017-03-09T09:26:00Z","modified":"2026-06-17T01:22:33Z","products":[{"vendor":"cmsmadesimple","product":"cms_made_simple"}],"references":[{"url":"http://www.daimacn.com/?id=8","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/96933","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6556"},{"url":"https://github.com/advisories/GHSA-xrwq-4gxw-wvh5"}],"sources":{"cve":[{"id":"CVE-2017-6556","description":"Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the \"adminpage \u003e sitesetting \u003e General Settings \u003e globalmetadata\" field.","status":"published","published":"2017-03-09T09:26:00Z","modified":"2024-08-05T15:33:20.193Z","updated_at":"2026-11-02T14:33:16.578111Z"}],"euvd":[{"id":"EUVD-2017-15612","description":"Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the \"adminpage \u003e sitesetting \u003e General Settings \u003e globalmetadata\" field.","status":"published","published":"2017-03-09T09:26:00Z","modified":"2024-08-05T15:33:20Z","updated_at":"2026-11-03T02:39:12.023695Z"}],"ghsa":[{"id":"GHSA-xrwq-4gxw-wvh5","title":"Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote...","description":"Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the \"adminpage \u003e sitesetting \u003e General Settings \u003e globalmetadata\" field.","status":"published","published":"2022-05-17T02:54:55Z","modified":"2023-01-27T05:06:05Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:42:49.857991Z"}],"nvd":[{"id":"CVE-2017-6556","description":"Cross-site scripting (XSS) vulnerability in CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the \"adminpage \u003e sitesetting \u003e General Settings \u003e globalmetadata\" field.","status":"published","published":"2017-03-09T09:59:00.347Z","modified":"2026-06-17T01:22:33.847Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:43.325192Z"}]}}