In CMS Made Simple (CMSMS) through 2.2.7 the \module import\ operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because an XML Package can contain base64-encoded PHP code in a data element.