What is CVE-2021-47736?

CVE-2021-47736 is a high-severity vulnerability in Cmsimple-xh Cmsimple_xh, classified under Code Injection. CVSS score: 7.2/10. Published 2025-12-23.

How severe is CVE-2021-47736?

High severity. CVSS v3 base score is 7.2 out of 10.

RCE in Cmsimple-xh Cmsimple_xh

CVE-2021-47736

CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF toke…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.009 (56.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Cmsimple-xh Cmsimple_xh — versions 1.7.4

Weakness classification (CWE)

CWE-94 — Code Injection

References

disclosure@vulncheck.com (Exploit, VDB Entry, Third Party Advisory, exploit)
disclosure@vulncheck.com (Product, product)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2021-47736?: CVE-2021-47736 is a high-severity vulnerability in Cmsimple-xh Cmsimple_xh, classified under Code Injection. CVSS score: 7.2/10. Published 2025-12-23.
How severe is CVE-2021-47736?: High severity. CVSS v3 base score is 7.2 out of 10.