CVE-2021-47918
Simple CMS 2.1 SQL Injection Vulnerability via Users Module
- State
- Published
- Severity
- 8.6 High
- Published
- Feb 1, 2026
- Updated
- Mar 5, 2026
- Reserved
- Feb 1, 2026
Description
Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
Simple CMSSimplephpscripts |
|
References
- Vulnerability Lab Advisoryexploit
- Product Homepageproduct
- VulnCheck Advisory: Simple CMS 2.1 SQL Injection Vulnerability via Users Modulethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.