CVE-2021-47735

Katalog CVE

CVSS 8.8 · High EPSS 0,88%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada cmsimple. Skor CVSS 3.1 8.8 (High) menurut vulncheck.com.

Deskripsi (NVD)

CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF token.

Rincian

Terbit di NVD

23 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 58,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.vulncheck.com/advisories/cmsimple-authenticated-remote-code-execution-via-template-editing advisory pihak ketiga
• https://www.exploit-db.com/exploits/50356 exploit
• https://www.cmsimple.org/ product