The news module in CMSMS prior to 1.9.4.3 allows remote malicious users to corrupt new articles.
cmsmadesimple cms made simple