{"id":"CVE-2019-9053","aliases":["EUVD-2019-18439","GHSA-rrqg-2h39-2567"],"status":"published","title":"An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a...","description":"An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.68581,"percentile":0.99344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2019-03-26T16:15:38Z","modified":"2026-06-17T02:42:59Z","exploits":[{"source":"exploitdb","id":"EDB-46635","title":"CMS Made Simple \u003c 2.2.10 - SQL Injection","type":"webapps","platform":"php","date":"2019-04-02","url":"https://www.exploit-db.com/exploits/46635"},{"source":"pocgithub","id":"d3athcod3/46635.py_CVE-2019-9053","title":"d3athcod3/46635.py_CVE-2019-9053","date":"2021-05-14","url":"https://github.com/d3athcod3/46635.py_CVE-2019-9053"},{"source":"pocgithub","id":"h3x0v3rl0rd/CVE-2019-9053","title":"h3x0v3rl0rd/CVE-2019-9053","date":"2021-07-18","url":"https://github.com/h3x0v3rl0rd/CVE-2019-9053"},{"source":"pocgithub","id":"maraspiras/46635.py","title":"maraspiras/46635.py","date":"2021-12-09","url":"https://github.com/maraspiras/46635.py"},{"source":"pocgithub","id":"4nner/CVE-2019-9053","title":"4nner/CVE-2019-9053","date":"2021-12-28","url":"https://github.com/4nner/CVE-2019-9053"},{"source":"pocgithub","id":"zmiddle/Simple_CMS_SQLi","title":"zmiddle/Simple_CMS_SQLi","date":"2022-10-08","url":"https://github.com/zmiddle/Simple_CMS_SQLi"},{"source":"pocgithub","id":"ELIZEUOPAIN/CVE-2019-9053-CMS-Made-Simple-2.2.10---SQL-Injection-Exploit","title":"ELIZEUOPAIN/CVE-2019-9053-CMS-Made-Simple-2.2.10---SQL-Injection-Exploit","date":"2022-10-25","url":"https://github.com/ELIZEUOPAIN/CVE-2019-9053-CMS-Made-Simple-2.2.10---SQL-Injection-Exploit"},{"source":"pocgithub","id":"Mahamedm/CVE-2019-9053-Exploit-Python-3","title":"Mahamedm/CVE-2019-9053-Exploit-Python-3","date":"2023-05-29","url":"https://github.com/Mahamedm/CVE-2019-9053-Exploit-Python-3"},{"source":"pocgithub","id":"im-suman-roy/CVE-2019-9053","title":"im-suman-roy/CVE-2019-9053","date":"2023-07-04","url":"https://github.com/im-suman-roy/CVE-2019-9053"},{"source":"pocgithub","id":"kahluri/CVE-2019-9053","title":"kahluri/CVE-2019-9053","date":"2023-08-07","url":"https://github.com/kahluri/CVE-2019-9053"},{"source":"pocgithub","id":"fernandobortotti/CVE-2019-9053","title":"fernandobortotti/CVE-2019-9053","date":"2023-10-16","url":"https://github.com/fernandobortotti/CVE-2019-9053"},{"source":"pocgithub","id":"byrek/CVE-2019-9053","title":"byrek/CVE-2019-9053","date":"2023-11-20","url":"https://github.com/byrek/CVE-2019-9053"},{"source":"pocgithub","id":"dawcwikla/CVE-2019-9053-exploit","title":"dawcwikla/CVE-2019-9053-exploit","date":"2023-11-26","url":"https://github.com/dawcwikla/CVE-2019-9053-exploit"},{"source":"pocgithub","id":"BjarneVerschorre/CVE-2019-9053","title":"BjarneVerschorre/CVE-2019-9053","date":"2023-11-29","url":"https://github.com/BjarneVerschorre/CVE-2019-9053"},{"source":"pocgithub","id":"Jason-Siu/CVE-2019-9053-Exploit-in-Python-3","title":"Jason-Siu/CVE-2019-9053-Exploit-in-Python-3","date":"2024-02-21","url":"https://github.com/Jason-Siu/CVE-2019-9053-Exploit-in-Python-3"},{"source":"pocgithub","id":"0xftorres/CVE-2019-9053-Fixed","title":"0xftorres/CVE-2019-9053-Fixed","date":"2024-05-17","url":"https://github.com/0xftorres/CVE-2019-9053-Fixed"},{"source":"pocgithub","id":"Dh4nuJ4/SimpleCTF-UpdatedExploit","title":"Dh4nuJ4/SimpleCTF-UpdatedExploit","date":"2024-06-20","url":"https://github.com/Dh4nuJ4/SimpleCTF-UpdatedExploit"},{"source":"pocgithub","id":"TeymurNovruzov/CVE-2019-9053-python3-remastered","title":"TeymurNovruzov/CVE-2019-9053-python3-remastered","date":"2024-06-25","url":"https://github.com/TeymurNovruzov/CVE-2019-9053-python3-remastered"},{"source":"pocgithub","id":"jtoalu/CTF-CVE-2019-9053-GTFOBins","title":"jtoalu/CTF-CVE-2019-9053-GTFOBins","date":"2024-08-09","url":"https://github.com/jtoalu/CTF-CVE-2019-9053-GTFOBins"},{"source":"pocgithub","id":"Azrenom/CMS-Made-Simple-2.2.9-CVE-2019-9053","title":"Azrenom/CMS-Made-Simple-2.2.9-CVE-2019-9053","date":"2024-09-21","url":"https://github.com/Azrenom/CMS-Made-Simple-2.2.9-CVE-2019-9053"},{"source":"pocgithub","id":"Ap0cryph1c/CVE-2019-9053","title":"Ap0cryph1c/CVE-2019-9053","date":"2024-10-26","url":"https://github.com/Ap0cryph1c/CVE-2019-9053"},{"source":"pocgithub","id":"Yzhacker/CVE-2019-9053-CMS46635-python3","title":"Yzhacker/CVE-2019-9053-CMS46635-python3","date":"2025-02-13","url":"https://github.com/Yzhacker/CVE-2019-9053-CMS46635-python3"},{"source":"pocgithub","id":"hf3cyber/CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053-","title":"hf3cyber/CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053-","date":"2025-03-05","url":"https://github.com/hf3cyber/CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053-"},{"source":"pocgithub","id":"so1icitx/CVE-2019-9053","title":"so1icitx/CVE-2019-9053","date":"2025-03-31","url":"https://github.com/so1icitx/CVE-2019-9053"},{"source":"pocgithub","id":"Hackheart-tech/-exploit-lab","title":"Hackheart-tech/-exploit-lab","date":"2025-04-15","url":"https://github.com/Hackheart-tech/-exploit-lab"},{"source":"pocgithub","id":"del0x3/CVE-2019-9053-port-py3","title":"del0x3/CVE-2019-9053-port-py3","date":"2025-04-15","url":"https://github.com/del0x3/CVE-2019-9053-port-py3"}],"exploits_more":21,"products":[{"vendor":"cmsmadesimple","product":"cms_made_simple"}],"references":[{"url":"https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46635/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/Perseus99999/CVE-2019-9053-working-/blob/main/exploit.py"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9053"},{"url":"https://www.exploit-db.com/exploits/46635"},{"url":"https://github.com/advisories/GHSA-rrqg-2h39-2567"}],"sources":{"cve":[{"id":"CVE-2019-9053","description":"An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.","status":"published","published":"2019-03-26T16:15:38Z","modified":"2025-11-17T19:19:52.125Z","updated_at":"2026-11-02T14:20:20.397093Z"}],"euvd":[{"id":"EUVD-2019-18439","description":"An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.","status":"published","published":"2019-03-26T16:15:38Z","modified":"2025-11-17T19:19:52Z","updated_at":"2026-11-02T19:49:16.200687Z"}],"ghsa":[{"id":"GHSA-rrqg-2h39-2567","title":"An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a...","description":"An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.","status":"published","published":"2022-05-14T01:07:06Z","modified":"2025-11-17T21:32:21Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:04:50.199532Z"}],"nvd":[{"id":"CVE-2019-9053","description":"An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.","status":"published","published":"2019-03-26T17:29:01.42Z","modified":"2026-06-17T02:42:59.433Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:05:09.523883Z"}]}}