CMSimple XH 1.8.0
Approved changes feed: RSS · Atom
cpe:2.3:a:cmsimple-xh:cmsimple_xh:1.8.0:-:*:*:*:*:*:*part: a version: 1.8.0 update: -
| Vendor | Cmsimple Xh (e4d4868b-567d-5c21-a086-8e214d2d4297) |
|---|---|
| Product | Cmsimple Xh (e4e8a806-cb9b-5f49-9feb-3deebcea4564) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cmsimple-xh/cmsimple-xh |
purl2cpe | 2026-06-01 10:15:47.668805 |
pkg:sourceforge/cmsimplexh |
purl2cpe | 2026-06-01 10:15:47.668806 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-63589 |
vulnerable | 2026-06-08 07:39:17.669400 |
Details available
A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims' browsers visiting a crafted URL.
Published: 2025-11-06T00:00:00.000Z
Updated: 2025-11-06T19:12:48.998Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-63588 |
vulnerable | 2026-06-08 07:39:17.668907 |
Details available
An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a maliciously crafted POST login). Successful exploitation may lead to theft of session cookies, credential disclosure, or other client-side impacts.
Published: 2025-11-06T00:00:00.000Z
Updated: 2025-11-06T19:10:56.777Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.