What’s Vulnerable › Vulnerabilities

CVE-2021-47734: CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-23 · updated 2026-06-17
• Weakness: CWE-98

Description

CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.

Affected products

• CMSimple: 5.4

References

• https://www.cmsimple.org/en/
• https://www.exploit-db.com/exploits/50547
• https://www.vulncheck.com/advisories/cmsimple-authenticated-local-file-inclusion-remote-code-execution

Get alerted when CVE-2021-47734 or the next vulnerability affects your stack