Cmsimple

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

Cmsimple records in CISA KEV

No Cmsimple vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cmsimple 19 records HIGH Cmsimple Classic 1 record LOW

Records

19 records in Cmsimple · all components

TI-2024-37939 CVE-2024-57548 · GHSA-qx57-5369-xrr8

CMSimple 5.16 allows the user to edit log.php file via print page.

HIGH 80

CMSimple 5.16 allows the user to edit log.php file via print page.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00475 Published 2025-01-27 No fix listed CWE-276

TI-2024-37940 CVE-2024-57549 · GHSA-r2h5-cvfq-6cgj

CMSimple 5.16 allows the user to read cms source code through manipulation of the file…

HIGH 72

CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00665 Published 2025-01-27 No fix listed CWE-22

TI-2024-37938 CVE-2024-57547 · GHSA-6m9w-gxx9-4gqr

Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain…

HIGH 72

Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the Functionality of downloading php backup files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00573 Published 2025-01-27 No fix listed CWE-732

TI-2024-37937 CVE-2024-57546 · GHSA-h75c-q767-27j6

An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via…

HIGH 72

An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00588 Published 2025-01-27 No fix listed CWE-922

TI-2021-22352 CVE-2021-47735 · GHSA-9q7q-6c8f-q8gh

CMSimple 5.4 Authenticated Remote Code Execution via Template Editing

HIGH 72

CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00884 Published 2025-12-23 No fix listed CWE-94

TI-2021-22351 CVE-2021-47734 · GHSA-62fv-j8g5-r47m

CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution

HIGH 72

CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00782 Published 2025-12-23 No fix listed CWE-98

TI-2024-22055 CVE-2024-33423 · GHSA-3849-33qq-vw2c

Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows…

HIGH 66

Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language sectio…

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00558 Published 2024-05-01 No fix listed CWE-80

TI-2024-21293 CVE-2024-32345 · GHSA-72rp-2fhc-9m4p

A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows…

HIGH 65

A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Configuration parameter under the Langua…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00456 Published 2024-04-17 No fix listed CWE-79

TI-2024-21292 CVE-2024-32344 · GHSA-w22g-gw2j-fp4p

A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows…

MEDIUM 63

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00528 Published 2024-04-17 No fix listed CWE-79

TI-2024-21314 CVE-2024-32392 · GHSA-x7wx-mcvx-6wwv

Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute…

MEDIUM 56

Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component.

CVSS 3.1MEDIUM 4.5 Network High privileges User interaction EPSS 0.00774 Published 2024-04-19 No fix listed CWE-79

TI-2021-22350 CVE-2021-47733 · GHSA-m47r-hm3g-h92f

CMSimple 5.4 Cross-Site Scripting via HTML Unicode Encoding

MEDIUM 56

CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00264 Published 2025-12-23 No fix listed CWE-79

TI-2021-22349 CVE-2021-47732 · GHSA-48vh-4wjm-4mch

CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input

MEDIUM 56

CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00268 Published 2025-12-23 No fix listed CWE-79

TI-2021-19553 CVE-2021-43741 · GHSA-pf7h-2j4w-49wx

CMSimple 5.4 is vulnerable to Directory Traversal.

MEDIUM 50

CMSimple 5.4 is vulnerable to Directory Traversal.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04719 Published 2022-04-13 No fix listed CWE-22

TI-2008-02540 CVE-2008-2650 · GHSA-gh4f-5wmx-wwgh

Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when…

MEDIUM 48

Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a ..

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.18809 Published 2008-06-10 No fix listed CWE-22

TI-2024-38377 CVE-2024-58280 · GHSA-mc4p-3xcw-5f46

CMSimple 5.15 Remote Command Execution via Extensions Configuration

MEDIUM 41

CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00941 Published 2025-12-10 No fix listed CWE-403

TI-2024-22056 CVE-2024-33424 · GHSA-q2mm-7g26-cqpf

A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows…

LOW 27

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00404 Published 2024-05-01 No fix listed CWE-79

TI-2021-19554 CVE-2021-43742 · GHSA-gmjx-v99c-7jj2

CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature.

LOW 25

CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0057 Published 2022-04-13 No fix listed CWE-79

TI-2018-13813 CVE-2018-19508 · GHSA-m7g6-7f8c-v654

CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI.

LOW 23

CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00559 Published 2018-12-19 No fix listed CWE-79

TI-2018-13812 CVE-2018-19507 · GHSA-ffm4-5w5h-7r42

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.

LOW 23

CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI.

CVSS 3.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00559 Published 2018-12-19 No fix listed CWE-79

Open these records in search →