Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Vendor: Cmsimple-Xh Clear all filters
TI-2021-22353 CVE-2021-47736 · GHSA-353h-pmfp-h8fp

CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing

Priority HIGH 72

CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01077 Published 2025-12-23 No fix listed CWE-94
TI-2025-39375 CVE-2025-63589 · GHSA-vjvr-7hrq-r8p6

A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when…

Priority MEDIUM 64

A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs,…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00355 Published 2025-11-06 No fix listed CWE-79
TI-2025-39374 CVE-2025-63588 · GHSA-gj82-c7f3-xr2m

An unauthenticated reflected cross-site scripting vulnerability in the query handling of…

Priority MEDIUM 64

An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00359 Published 2025-11-06 No fix listed CWE-79