GCVE - cpe:2.3:a:cmsimple:cmsimple:5.15:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cmsimple:cmsimple:5.15:*:*:*:*:*:*:*

part: a version: 5.15 update: *

Vendor	Cmsimple (`f2c7c4cc-d0b2-5953-ab3b-92edfc4bef64`)
Product	Cmsimple (`fc4552ca-806b-522d-9087-0b34b3e6cbdb`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-58280`	vulnerable	2026-06-08 06:56:14.338815	CMSimple 5.15 Remote Command Execution via Extensions Configuration CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensions_userfiles and upload a shell script to the media directory to execute arbitrary code on the server. Published: 2025-12-10T21:13:33.152Z Updated: 2026-04-07T14:08:33.724Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/52040 https://www.cmsimple.org https://www.cmsimple.org/downloads_cmsimple50/CMSimple_5-15.zip https://www.vulncheck.com/advisories/cmsimple-remote-command-execution-via-extensions-configuration	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-33424`	vulnerable	2026-06-08 06:37:31.126203	Details available A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section. Published: 2024-05-01T00:00:00.000Z Updated: 2024-08-02T02:27:53.627Z Open on db.gcve.eu Reference links https://github.com/adiapera/xss_language_cmsimple_5.15	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-33423`	vulnerable	2026-06-08 06:37:31.125042	Details available Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section. Published: 2024-05-01T00:00:00.000Z Updated: 2024-08-02T02:27:53.687Z Open on db.gcve.eu Reference links https://github.com/adiapera/xss_language_cmsimple_5.15	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-32392`	vulnerable	2026-06-08 06:35:33.097395	Details available Cross Site Scripting vulnerability in CmSimple v.5.15 allows a remote attacker to execute arbitrary code via the functions.php component. Published: 2024-04-19T00:00:00.000Z Updated: 2024-08-02T02:06:44.226Z Open on db.gcve.eu Reference links https://github.com/Hebing123/cve/issues/33	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-32345`	vulnerable	2026-06-08 06:35:33.067647	Details available A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Configuration parameter under the Language section. Published: 2024-04-17T00:00:00.000Z Updated: 2024-11-22T14:15:38.783Z Open on db.gcve.eu Reference links https://github.com/adiapera/xss_language_cmsimple_5.15	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-32344`	vulnerable	2026-06-08 06:35:33.067219	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.