CVE-2021-47735 | High | 8.8 | 2025-12-23 | CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. At… |
CVE-2021-47734 | High | 7.8 | 2025-12-23 | CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary co… |
CVE-2021-47733 | Medium | 6.1 | 2025-12-23 | CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inj… |
CVE-2021-47732 | Medium | 6.1 | 2025-12-23 | CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript… |
CVE-2024-58280 | High | 8.8 | 2025-12-10 | CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. A… |
CVE-2024-57549 | High | 7.5 | 2025-01-27 | CMSimple 5.16 allows the user to read cms source code through manipulation of the file name in the file parameter of a GET request. |
CVE-2024-57548 | Critical | 9.1 | 2025-01-27 | CMSimple 5.16 allows the user to edit log.php file via print page. |
CVE-2024-57547 | High | 7.5 | 2025-01-27 | Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the Functionality of dow… |
CVE-2024-57546 | High | 7.5 | 2025-01-27 | An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function. |
CVE-2024-33423 | High | 7.4 | 2024-05-01 | Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload… |
CVE-2024-33424 | Medium | 6.1 | 2024-05-01 | A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2024-32392 | Medium | 4.5 | 2024-04-19 | Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component. |
CVE-2024-32345 | High | 7.2 | 2024-04-17 | A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2024-32344 | Medium | 6.8 | 2024-04-17 | A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2021-43741 | Critical | 9.8 | 2022-04-13 | CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote… |
CVE-2021-43742 | Medium | 5.4 | 2022-04-13 | CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature. |
CVE-2018-19508 | Medium | 4.8 | 2018-12-19 | CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI. |
CVE-2018-19507 | Medium | 4.8 | 2018-12-19 | CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI. |
CVE-2014-2219 | | | 2014-03-20 | Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remo… |
CVE-2008-2650 | | | 2008-06-10 | Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when register_globals is enabled, allows remote attackers to include and execute arbitra… |