CVE-2019-9693: Cmsmadesimple CMS Made Simple

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

In CMS Made Simple (CMSMS) before 2.2.10, an authenticated user can achieve SQL Injection in class.showtime2_data.php via the functions _updateshow (parameter show_id), _inputshow (parameter show_id), _Getshowinfo (parameter show_id), _Getpictureinfo (parameter picture_id), _AdjustNameSeq (parameter shownumber), _Updatepicture (parameter picture_id), and _Deletepicture (parameter picture_id).

Affected products

• Cmsmadesimple CMS Made Simple: before 2.2.10 (fixed in 2.2.10)

Published 2019-03-11. Last modified 2026-06-17.