CVE-2021-47860

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47860
GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote code on the hosting server when an authenticated administrator visits the page.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://get-simple.info Product
https://github.com/GetSimpleCMS/GetSimpleCMS Product
https://github.com/boku7/gsCMS-CustomJS-Csrf2Xss2Rce Exploit Third Party Advisory
https://www.exploit-db.com/exploits/49712 Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/49816 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/getsimple-cms-custom-js-csrf-to-xss-to-rce Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:get-simple:getsimplecms:0.1:*:*:*:*:*:*:*
History

17 Jun 2026, 04:18

Type Values Removed Values Added
Summary
  • (es) El plugin GetSimple CMS Custom JS 0.1 contiene una vulnerabilidad de falsificación de petición en sitios cruzados que permite a atacantes no autenticados inyectar código arbitrario del lado del cliente en los navegadores de los administradores. Los atacantes pueden crear un sitio web malicioso que activa una carga útil de cross-site scripting para ejecutar código remoto en el servidor de alojamiento cuando un administrador autenticado visita la página.

06 Mar 2026, 20:10

Type Values Removed Values Added
References () http://get-simple.info - () http://get-simple.info - Product
References () https://github.com/GetSimpleCMS/GetSimpleCMS - () https://github.com/GetSimpleCMS/GetSimpleCMS - Product
References () https://github.com/boku7/gsCMS-CustomJS-Csrf2Xss2Rce - () https://github.com/boku7/gsCMS-CustomJS-Csrf2Xss2Rce - Exploit, Third Party Advisory
References () https://www.exploit-db.com/exploits/49712 - () https://www.exploit-db.com/exploits/49712 - Exploit, Third Party Advisory, VDB Entry
References () https://www.exploit-db.com/exploits/49816 - () https://www.exploit-db.com/exploits/49816 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/getsimple-cms-custom-js-csrf-to-xss-to-rce - () https://www.vulncheck.com/advisories/getsimple-cms-custom-js-csrf-to-xss-to-rce - Third Party Advisory
CPE cpe:2.3:a:get-simple:getsimplecms:0.1:*:*:*:*:*:*:*
First Time Get-simple
Get-simple getsimplecms

21 Jan 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-21 18:16

Updated : 2026-06-17 04:18

NVD link : CVE-2021-47860

Mitre link : CVE-2021-47860

CVE.ORG link : CVE-2021-47860

JSON object : View

Products Affected

get-simple

  • getsimplecms
CWE
CWE-352

Cross-Site Request Forgery (CSRF)