CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Cmsimple
  • Cmsimple

Configuration 1 [-]

cpe:2.3:a:cmsimple:cmsimple:5.2:*:*:*:*:*:*:*

No data.

References
Link Providers
https://www.cmsimple.org/en/ cve-icon cve-icon
https://www.exploit-db.com/exploits/49751 cve-icon cve-icon
https://www.vulncheck.com/advisories/cmsimple-stored-cross-site-scripting-via-filebrowser-external-input cve-icon cve-icon
History

Mon, 05 Jan 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Wed, 31 Dec 2025 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:cmsimple:cmsimple:5.2:*:*:*:*:*:*:*

Wed, 24 Dec 2025 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Cmsimple
Cmsimple cmsimple
Vendors & Products Cmsimple
Cmsimple cmsimple

Tue, 23 Dec 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 23 Dec 2025 19:45:00 +0000

Type Values Removed Values Added
Description CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.
Title CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2025-12-23T19:34:07.775Z

Updated: 2026-01-05T14:09:52.600Z

Reserved: 2025-12-23T13:24:04.578Z

Link: CVE-2021-47732

cve-icon Vulnrichment

Updated: 2025-12-23T20:45:26.939Z

cve-icon NVD

Status : Modified

Published: 2025-12-23T20:15:44.823

Modified: 2026-01-05T14:15:51.297

Link: CVE-2021-47732

cve-icon Redhat

No data.