CVE-2021-47778

Katalog CVE

CVSS 7.2 · High EPSS 1,3%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada get-simple getsimplecms. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.

Rincian

Terbit di NVD

21 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/boku7/gsSMTP-Csrf2Xss2RCE/ exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/49774 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/getsimple-cms-my-smtp-contact-plugin-php-code-injection advisory pihak ketiga
• http://get-simple.info product
• https://github.com/GetSimpleCMS/GetSimpleCMS product