PT-2026-5563 · Unknown · Simple-Cms

Published 2026-02-01 · Updated 2026-02-05 · CVE-2021-47918

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Simple CMS version 2.1

Description The Simple CMS software contains a remote SQL injection issue. Privileged attackers can inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the admin.php file to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-47918

Affected Products

Simple-Cms

References · 9

• 🔥 https://vulnerability-lab.com/get_content.php?id=2303 · Exploit
• https://osv.dev/vulnerability/CVE-2021-47918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47918 · Security Note
• https://vulncheck.com/advisories/simple-cms-sql-injection-vulnerability-via-users-module2 · Note
• https://t.me/CVEtracker/43414 · Telegram Post
• https://twitter.com/cracbot/status/2019365433472872733 · Twitter Post
• https://t.me/cveNotify/150506 · Telegram Post
• https://simplephpscripts.com/simple-cms-php · Note
• https://twitter.com/CVEnew/status/2017954079365124270 · Twitter Post