Cmsimple vulnerabilities
We track 4 vulnerabilities in Cmsimple products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 10, 2025.
Latest Cmsimple vulnerabilities
- 8.8 High severity
CMSimple: Exposure of File Descriptor to Unintended Control Sphere
CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensions_userfiles and upload a shell script to the media directory t
- 7.5 High severity
Cmsimple: Incorrect Permission Assignment for Critical Resource
Insecure Permissions vulnerability in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the Functionality of downloading php backup files.
- 7.4 High severity
cmsimple: Improper Neutralization of Script-Related HTML Tags in a Web Page
Cross-Site Scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section.
- 7.2 High severity
cmsimple: Improper Neutralization of Input During Web Page Generation
A cross-site scripting (XSS) vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Configuration parameter under the Language section.