CVE-2021-47734
CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution
- State
- Published
- Severity
- 8.6 High
- Published
- Dec 23, 2025
- Updated
- Mar 17, 2026
- Reserved
- Dec 23, 2025
Description
CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected Products
| Product | Versions |
|---|---|
CMSimpleCmsimple |
|
References
- ExploitDB-50547exploit
- Official CMSimple Homepageproduct
- VulnCheck Advisory: CMSimple 5.4 Authenticated Local File Inclusion Remote Code Executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.