GCVE - cpe:2.3:a:cmsimple:cmsimple:5.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:cmsimple:cmsimple:5.4:*:*:*:*:*:*:*

part: a version: 5.4 update: *

Vendor	Cmsimple (`f2c7c4cc-d0b2-5953-ab3b-92edfc4bef64`)
Product	Cmsimple (`fc4552ca-806b-522d-9087-0b34b3e6cbdb`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2021-47735`	vulnerable	2026-06-08 05:38:07.529049	CMSimple 5.4 Authenticated Remote Code Execution via Template Editing HIGH (8.8) CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF token. Published: 2025-12-23T19:34:09.077Z Updated: 2026-03-05T12:02:27.210Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/50356 https://www.cmsimple.org/ https://www.vulncheck.com/advisories/cmsimple-authenticated-remote-code-execution-via-template-editing	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-47734`	vulnerable	2026-06-08 05:38:07.528632	CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution HIGH (7.8) CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms. Published: 2025-12-23T19:34:08.612Z Updated: 2026-03-17T16:23:20.378Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/50547 https://www.cmsimple.org/en/ https://www.vulncheck.com/advisories/cmsimple-authenticated-local-file-inclusion-remote-code-execution	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-47733`	vulnerable	2026-06-08 05:38:07.528004	CMSimple 5.4 Cross-Site Scripting via HTML Unicode Encoding MEDIUM (6.1) CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like ')-alert(1)// and execute arbitrary JavaScript when victims interact with delete buttons. Published: 2025-12-23T19:35:44.454Z Updated: 2026-04-07T14:05:51.179Z Open on db.gcve.eu Reference links https://www.exploit-db.com/exploits/50612 https://www.cmsimple.org/en/ https://www.vulncheck.com/advisories/cmsimple-cross-site-scripting-via-html-unicode-encoding	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-43742`	vulnerable	2026-06-08 05:36:43.914227	Details available CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature. Published: 2022-04-13T12:19:20.000Z Updated: 2024-08-04T04:03:08.662Z Open on db.gcve.eu Reference links https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities https://github.com/iiSiLvEr/CVEs/tree/main/CVE-2021-43742	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-43741`	vulnerable	2026-06-08 05:36:43.913802	Details available CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution. Published: 2022-04-13T13:16:10.000Z Updated: 2024-08-04T04:03:08.801Z Open on db.gcve.eu Reference links https://github.com/iiSiLvEr/CMSimple5.4-Vulnerabilities https://github.com/iiSiLvEr/CVEs/tree/main/CVE-2021-43741	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.