CVE-2021-47870

Katalog CVE

CVSS 5.4 · Medium EPSS 0,27%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada get-simple getsimplecms. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize user input using htmlspecialchars(), but this can be bypassed by passing dangerous characters as escaped hex bytes. This allows attackers to inject arbitrary client-side code that executes in the administrator's browser when visiting a malicious page.

Rincian

Terbit di NVD

21 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/boku7/gsSMTP-Csrf2Xss2RCE/ exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/49798 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/getsimple-cms-my-smtp-contact-plugin-stored-xss advisory pihak ketiga
• http://get-simple.info product
• https://github.com/GetSimpleCMS/GetSimpleCMS product