CyberSec.Space Logo
Back to CVE Browser

CVE-2021-47735

HIGH
8.8
CVSS Severity Score
EPSS Score0.0230%
EPSS Percentile32.91th
PublishedDec 23, 2025
Last ModifiedDec 31, 2025

Vulnerability Description

CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF token.

Affected Platforms (CPE)

📦
Cmsimple

Cmsimple

= 5.4

References & Advisories

🔗 https://www.cmsimple.org/
🔗 https://www.exploit-db.com/exploits/50356
🔗 https://www.vulncheck.com/advisories/cmsimple-authenticated-remote-code-execution-via-template-editing

Related Vulnerabilities

CVE-2021-4264510.0

CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker must use ...

CVE-2021-437419.8

CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on...

CVE-2021-477347.8

CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session f...

CVE-2007-05517.5

Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary...