CVE-2017-16783

CRITICAL ⚠ Exploit

In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.

Affects 2 products across 1 vendor.

CVSS 3.19.8
EPSS8.0%
Percentile95th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-94: Code Injection

Attacker injects arbitrary code that is executed by the application process.

Related Attack Patterns (CAPEC)
CAPEC-35 Leverage Executable Code in Non-Executable Files
via CWE-94
CAPEC-77 Manipulating User-Controlled Variables
via CWE-94
CAPEC-242 Code Injection
via CWE-94

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability exists in CMS Made Simple 2.1.6, allowing for Server-Side Template Injection (SSTI) through the cntnt01detailtemplate parameter, which could lead to remote code execution.

BSID: BS-2017-GLOBAL-162502-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2017-16783?
A critical vulnerability exists in CMS Made Simple 2.1.6, allowing for Server-Side Template Injection (SSTI) through the cntnt01detailtemplate parameter, which could lead to remote code execution.
What is the CVSS score for CVE-2017-16783?
CVE-2017-16783 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 8.0%.
Is CVE-2017-16783 actively exploited?
Public exploit available for CVE-2017-16783. Exploitation risk elevated.
How do I remediate CVE-2017-16783?
Priority: IMMEDIATE.
What systems are affected by CVE-2017-16783?
CVE-2017-16783 affects Cmsmadesimple Cms Made Simple.
Vulnerability Details
CVE IDCVE-2017-16783
BSIDBS-2017-GLOBAL-162502-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2017-11-10
Last Modified2026-05-13
ICS Relevance15%
Weakness (CWE)
Code Injection
SourceNVD
Official Description

In CMS Made Simple 2.1.6, there is Server-Side Template Injection via the cntnt01detailtemplate parameter.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit this vulnerability by injecting malicious templates into the cntnt01detailtemplate parameter, potentially leading to arbitrary code execution on the server.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Cmsmadesimple Cms Made Simple 2.1.6
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 3261 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Cmsmadesimple
CVE-2010-4663 10.0 Unspecified vulnerability in the News module in CMS Made Simple (CMSMS) befor... CVE-2017-17734 9.8 CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login informatio... CVE-2017-17735 9.8 CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login informatio... CVE-2017-6070 9.8 CMS Made Simple version 1.x Form Builder before version 0.8.1.6 allows remote... CVE-2017-1000453 9.8 CMS Made Simple version 2.1.6 and 2.2 are vulnerable to Smarty templating inj...
View all Cmsmadesimple CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →