{"id":"CVE-2021-47734","aliases":["EUVD-2025-204835","GHSA-62fv-j8g5-r47m"],"status":"published","title":"CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution","description":"CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00782,"percentile":0.56269,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-98"],"published":"2025-12-23T19:34:08Z","modified":"2026-06-17T04:18:23Z","products":[{"vendor":"cmsimple","product":"cmsimple"}],"references":[{"url":"https://www.exploit-db.com/exploits/50547","tags":["exploit","Exploit"]},{"url":"https://www.cmsimple.org/en/","tags":["product","Product"]},{"url":"https://www.vulncheck.com/advisories/cmsimple-authenticated-local-file-inclusion-remote-code-execution","tags":["third-party-advisory","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47734"},{"url":"https://www.cmsimple.org/en"},{"url":"https://github.com/advisories/GHSA-62fv-j8g5-r47m"}],"sources":{"cve":[{"id":"CVE-2021-47734","title":"CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution","description":"CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.","status":"published","published":"2025-12-23T19:34:08.612Z","modified":"2026-03-17T16:23:20.378Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:32:56.689433Z"}],"euvd":[{"id":"EUVD-2025-204835","description":"CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.","status":"published","published":"2025-12-23T19:34:08Z","modified":"2026-03-17T16:23:20Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:25:33.306068Z"}],"ghsa":[{"id":"GHSA-62fv-j8g5-r47m","title":"CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote...","description":"CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.","status":"published","published":"2025-12-23T21:30:29Z","modified":"2025-12-23T21:30:40Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T15:05:19.885762Z"}],"nvd":[{"id":"CVE-2021-47734","description":"CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path and uploading malicious PHP code through session file upload mechanisms.","status":"published","published":"2025-12-23T20:15:45.123Z","modified":"2026-06-17T04:18:23.217Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:07:09.005706Z"}]}}