Read the docs

Cmsimple-Xh

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

Cmsimple-Xh records in CISA KEV

No Cmsimple-Xh vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Cmsimple Xh 5 records HIGH

Records

5 records

TI-2021-22353 CVE-2021-47736 · GHSA-353h-pmfp-h8fp

CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing

Priority HIGH 72

CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01077 Published 2025-12-23 No fix listed CWE-94
TI-2025-39375 CVE-2025-63589 · GHSA-vjvr-7hrq-r8p6

A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when…

Priority MEDIUM 64

A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs,…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00355 Published 2025-11-06 No fix listed CWE-79
TI-2025-39374 CVE-2025-63588 · GHSA-gj82-c7f3-xr2m

An unauthenticated reflected cross-site scripting vulnerability in the query handling of…

Priority MEDIUM 64

An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00359 Published 2025-11-06 No fix listed CWE-79
Open these records in search →