Vulnerability · Published Dec 23, 2025 · Assigned by VulnCheck
CVE-2021-47734CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution
High 7.8
In plain English
A high-severity security flaw in CMSimple from Cmsimple. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.8%top 43.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.
Affected products (as reported)
Weakness: CWE-98 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50547 exploit
- Official CMSimple Homepage product
- VulnCheck Advisory: CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution third-party-advisory