Stored Cross-Site Scripting Vulnerability in CMSimple by CMSimple
CVE-2021-47732

5.1MEDIUM

Key Information:

Vendor

Cmsimple

Status
Cmsimple
Vendor
CVE Published:
23 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2021-47732?

CMSimple 5.2 exhibits a stored cross-site scripting vulnerability specifically in the Filebrowser's external input field. This flaw permits malicious actors to inject unfiltered JavaScript code. When users navigate to the Page or Files tabs, the harmful script is executed, resulting in persistent script injection that compromises the integrity of the web application and threatens user security.

Affected Version(s)

CMSimple CMSimple 5.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-47732 - Proof of Concept

References

https://www.exploit-db.com/exploits/49751
exploit
https://www.cmsimple.org/en/
product
https://www.vulncheck.com/advisories/cmsimple-stored-cros...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Quadron Research Lab
JSON
.
CVE-2021-47732 : Stored Cross-Site Scripting Vulnerability in CMSimple by CMSimple