Vulnerability · Published Feb 1, 2026 · Assigned by VulnCheck
CVE-2021-47918Simple CMS 2.1 SQL Injection Vulnerability via Users Module
High 8.1
In plain English
A high-severity SQL injection in Simple CMS from Simplephpscripts. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 52.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Simplephpscripts | Simple CMS | 2.1 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- Vulnerability Lab Advisory exploit
- Product Homepage product
- VulnCheck Advisory: Simple CMS 2.1 SQL Injection Vulnerability via Users Module third-party-advisory