CVE-2021-47918

Simple CMS 2.1 SQL Injection Vulnerability via Users Module

CVSS 8.6 HIGHEPSS 0.5%CWE-89

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.6EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

01 Feb 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected products

Simplephpscripts · Simple CMS

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://simplephpscripts.com/simple-cms-php https://www.vulncheck.com/advisories/simple-cms-sql-injection-vulnerability-via-users-module2 https://www.vulnerability-lab.com/get_content.php?id=2303