PT-2025-52836 · Unknown · Cmsimple Xh

Halit Akaydin · CVE-2021-47736 · Published 2025-12-23 · Updated 2025-12-23

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions CMSimple XH version 1.7.4

Description The software contains an authenticated remote code execution issue in the content editing functionality. Administrative users can upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file, enabling arbitrary command execution on the server. The vulnerability allows for the execution of code on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-47736

Affected Products

Cmsimple Xh

References · 7

• 🔥 https://exploit-db.com/exploits/50367 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47736 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47736 · Vendor Advisory
• https://vulncheck.com/advisories/cmsimplexh-authenticated-remote-code-execution-via-content-editing · Note
• https://cmsimple-xh.org · Note
• https://twitter.com/CveFindCom/status/2003566075825238219 · Twitter Post
• https://twitter.com/CVEnew/status/2003567284061671451 · Twitter Post