TI-2015-07957 Aliases CVE-2015-10029 GHSA-rh3m-pr36-xh2f

kelvinmo simplexrd simplexrd.class.php xml external entity reference

MEDIUM 44CWE-611Published 2023-01-07 · Updated 2025-04-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file simplexrd/simplexrd.class.php. The manipulation leads to xml external entity reference. Upgrading to version 3.1.1 is able to address this issue. The patch is identified as 4c9f2e028523ed705b555eca2c18c64e71f1a35d. It is recommended to upgrade the affected component. VDB-217630 is the identifier assigned to this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0088 59th percentileScored 2026-11-07

Fix Fixed kelvinmo/simplexrd (Packagist): 3.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
kelvinmo	simplexrd	3.0; 3.1	—	No fix listed	CNA
—	kelvinmo/simplexrd (Packagist)	before 3.1.1	3.1.1	Patch available	GHSA-rh3m-pr36-xh2f

simplexrd Vendorkelvinmo Affected 3.0; 3.1 Fixed in — No fix listed CNA
kelvinmo/simplexrd (Packagist) Vendor— Affected before 3.1.1 Fixed in 3.1.1 Patch available GHSA-rh3m-pr36-xh2f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:simplexrd_project:simplexrd::::::::	before 3.1.1	Vulnerable	Simplexrd Project

cpe:2.3:a:simplexrd_project:simplexrd:*:*:*:*:*:*:*:* Versions before 3.1.1 Vulnerable ·Simplexrd Project

Remediation

Fix · GHSA-rh3m-pr36-xh2f kelvinmo/simplexrd (Packagist) Fixed in 3.1.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2015-10029
2026-10-03 Alias added: GHSA-rh3m-pr36-xh2f

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2015-10029

Other 1

https://github.com/kelvinmo/simplexrd

TI-2026-25625 SimpleJWT has an Unauthenticated Denial of Service via JWE header tampering CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences