nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2021-47732 CVE-2021-47732
MEDIUM
CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input
Record summary
CVE-2021-47732 has a selected CVSS score of 5.1 (medium); EIP currently links 1 catalogued exploit.
Description
CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 17, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
CMSimpleBrowse CMSimple / CMSimple | CVE List | CMSimple 5.2 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBCMSimple 5.2 - 'External' Stored XSSExploitDB exploitby Quadron Research LabNot analyzed1 file
References
4Official CMSimple Vendor Homepageproduct
https://www.cmsimple.org/en ExploitDB-49751exploit
https://www.exploit-db.com/exploits/49751 VulnCheck Advisory: CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External InputThird-party advisory
https://www.vulncheck.com/advisories/cmsimple-stored-cross-site-scripting-via-filebrowser-external-input