CVE-2021-47734

HIGH

CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-47734 has a selected CVSS score of 8.6 (high); EIP currently links 1 catalogued exploit.

Description

CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 17, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

CMSimple

Browse Cmsimple / CMSimple
CVE ListCMSimple 5.4affected

Proofs of concept

1

Catalogued exploits

ExploitDBCMSimple 5.4 - Local file inclusion (LFI) to Remote code execution (RCE) (Authenticated)ExploitDB exploitby S1lv3rNot analyzed1 file
ExploitDB
PoC details

References

4