What’s Vulnerable › Vulnerabilities

CVE-2021-47918: Simple CMS 2.1 SQL Injection Vulnerability via Users Module

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-01 · updated 2026-06-17
• Weakness: CWE-89

Description

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.

Affected products

• Simplephpscripts Simple CMS: 2.1

References

• https://simplephpscripts.com/simple-cms-php
• https://www.vulncheck.com/advisories/simple-cms-sql-injection-vulnerability-via-users-module2
• https://www.vulnerability-lab.com/get_content.php?id=2303

Get alerted when CVE-2021-47918 or the next vulnerability affects your stack