CVE-2021-47736
CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing
- State
- Published
- Severity
- 8.6 High
- Published
- Dec 23, 2025
- Updated
- Jul 15, 2026
- Reserved
- Dec 23, 2025
Description
CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file that enables arbitrary command execution on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
CMSimple_XHCmsimple-Xh |
|
References
- ExploitDB-50367exploit
- Official Vendor Homepageproduct
- VulnCheck Advisory: CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.