CVE-2017-6070: Cmsmadesimple CMS Made Simple

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote attackers to execute PHP code via the cntnt01fbrp_forma_form_template parameter in admin_store_form.

Affected products

• Cmsmadesimple CMS Made Simple: up to and including 1.12.2
• Cmsmadesimple Form Builder: up to and including 0.8.1.5

Published 2017-02-21. Last modified 2026-06-17.