CVE-2021-47732

MEDIUM

CMSimple 5.2 - Stored Cross-Site Scripting in Filebrowser External Input

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-47732. PoCs published by Quadron Research Lab.

AI-analyzed exploit summary This is a writeup describing a stored XSS vulnerability in CMSimple 5.2 via the 'External:' input field in the Filebrowser settings. The vulnerability allows execution of arbitrary JavaScript when clicking on the Page or Files tab.

Description

CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.

Exploits (1)

exploitdb WRITEUP
by Quadron Research Lab · textwebappsphp
https://www.exploit-db.com/exploits/49751

This is a writeup describing a stored XSS vulnerability in CMSimple 5.2 via the 'External:' input field in the Filebrowser settings. The vulnerability allows execution of arbitrary JavaScript when clicking on the Page or Files tab.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: CMSimple 5.2
Auth required
Prerequisites: Access to CMSimple admin panel · Valid credentials
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0024
EPSS Percentile 14.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
cmsimple/cmsimple 5.2
CMSimple/CMSimple CMSimple 5.2
Published Dec 23, 2025
Tracked Since Feb 18, 2026