CVE-2021-47918

8.6 highEPSS 0.6%

High (8.6) in simplephpscripts simple cms php. EPSS 0.6% chance of exploitation in the next 30 days.

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.

Severity

CVSS 4.0

8.6 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-02-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

simplephpscripts:simple_cms_php

References

https://simplephpscripts.com/simple-cms-php
https://www.vulncheck.com/advisories/simple-cms-sql-injection-vulnerability-via-users-module2
https://www.vulnerability-lab.com/get_content.php?id=2303

Check your stack JSON