CVE-2021-47736

CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing

High8.6Public exploitEPSS 1.1%

Published: 23 Dec 2025
Updated: 15 Jul 2026
Reserved: 23 Dec 2025
Assigned by: VulnCheck

Description

CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file that enables arbitrary command execution on the server.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-50367 (opens in a new tab)exploit

Timeline

2025
23 Dec 2025
23 Dec 2025
ID reserved
By VulnCheck
23 Dec 2025
23 Dec 2025
Published
2026
15 Jul 20267 months later
15 Jul 2026· 7 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2021-47736, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.6	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified	4.0	High8.6	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 1.1% · top 35% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.

Weakness

CWE-94: Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs

Affected products

Cmsimple-Xh · CMSimple_XH
- affected 1.7.4

References (3)

ExploitDB-50367 (opens in a new tab)exploit
Official Vendor Homepage (opens in a new tab)product
VulnCheck Advisory: CMSimple_XH 1.7.4 Authenticated Remote Code Execution via Content Editing (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2021-47736](https://trackcve.app/badge/CVE-2021-47736.svg)](https://trackcve.app/cve/CVE-2021-47736)

Record last updated 15 Jul 2026, 01:24 UTC.