CVE-2021-47735 — CMSimple 5.4 Authenticated Remote Code Execution via Template Editing
CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploi…
Published: 2025-12-23 · CVSS: 8.6 · CVSS 4.0
CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. Attackers can exploit the template editing functionality by crafting a reverse shell payload and saving it through the template editing endpoint with a valid CSRF token.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7