Vulnerability · Published Dec 23, 2025 · Assigned by VulnCheck
CVE-2021-47732CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input
Medium 6.1
In plain English
A medium-severity cross-site scripting in CMSimple from CMSimple. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 81.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- ExploitDB-49751 exploit
- Official CMSimple Vendor Homepage product
- VulnCheck Advisory: CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input third-party-advisory