CVE-2021-47732

CMSimple 5.2 Stored Cross-Site Scripting via Filebrowser External Input

MEDIUM 5.1EPSS 0.3%

CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript. Attackers can place unfiltered JavaScript code that executes when users click on Page or Files tabs, enabling persistent script injection.

Affected: CMSimple
CVSS v4.0 VULNCHECK: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 NVD: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.27% chance of exploitation in the next 30 days, 18th percentile
Published: 2025-12-23
Updated: 2026-04-07

Proof-of-concept exploits (1)

https://www.exploit-db.com/exploits/49751

Security advisories

https://www.vulncheck.com/advisories/cmsimple-stored-cross-site-scripting-via-filebrowser…
https://www.cmsimple.org/en

References

CVE Record
NVD entry