CVE-2021-47736

Katalog CVE

CVSS 7.2 · High EPSS 1,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada cmsimple-xh cmsimple xh. Skor CVSS 3.1 7.2 (High) menurut vulncheck.com.

Deskripsi (NVD)

CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file that enables arbitrary command execution on the server.

Rincian

Terbit di NVD

23 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.exploit-db.com/exploits/50367 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/cmsimplexh-authenticated-remote-code-execution-via-content-editing advisory pihak ketiga
• https://www.cmsimple-xh.org/ product