PT-2026-25635 · Undefined · Undefined

Feioklucy · Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-4225

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CMS Made Simple versions up to 2.2.21

Description A security issue exists in CMS Made Simple that allows for cross site scripting. The issue is located in the User Management Module, specifically within the admin/listusers.php file. Manipulation of the Message argument can trigger the flaw, and the attack can be carried out remotely. The exploit for this issue has been publicly released.

Recommendations Versions prior to 2.2.21 should be updated.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-4225

Affected Products

Undefined

References · 8

• 🔥 https://github.com/feixuezhi/cms/wiki · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4225 · Security Note
• https://t.me/CVEtracker/47521 · Telegram Post
• https://vuldb.com/?ctiid.351148 · Note
• https://vuldb.com/?submit.770530 · Note
• https://twitter.com/cyberbivash/status/2033467890125398159 · Twitter Post
• https://twitter.com/CVEnew/status/2033583689482047921 · Twitter Post
• https://vuldb.com/?id.351148 · Note