CVE-2021-47918

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47918
Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://simplephpscripts.com/simple-cms-php Product
https://www.vulncheck.com/advisories/simple-cms-sql-injection-vulnerability-via-users-module2 Broken Link
https://www.vulnerability-lab.com/get_content.php?id=2303 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:simplephpscripts:simple_cms_php:2.1:*:*:*:*:*:*:*
History

17 Jun 2026, 04:18

Type Values Removed Values Added
Summary
  • (es) Simple CMS 2.1 contiene una vulnerabilidad de inyección SQL remota que permite a atacantes privilegiados inyectar comandos SQL sin filtrar en el módulo de usuarios. Los atacantes pueden explotar parámetros de entrada no validados en el archivo admin.PHP para comprometer el sistema de gestión de base de datos y la aplicación web.

11 Feb 2026, 19:30

Type Values Removed Values Added
References () https://simplephpscripts.com/simple-cms-php - () https://simplephpscripts.com/simple-cms-php - Product
References () https://www.vulncheck.com/advisories/simple-cms-sql-injection-vulnerability-via-users-module2 - () https://www.vulncheck.com/advisories/simple-cms-sql-injection-vulnerability-via-users-module2 - Broken Link
References () https://www.vulnerability-lab.com/get_content.php?id=2303 - () https://www.vulnerability-lab.com/get_content.php?id=2303 - Exploit, Third Party Advisory
First Time Simplephpscripts simple Cms Php
Simplephpscripts
CPE cpe:2.3:a:simplephpscripts:simple_cms_php:2.1:*:*:*:*:*:*:*

01 Feb 2026, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-01 13:15

Updated : 2026-06-17 04:18

NVD link : CVE-2021-47918

Mitre link : CVE-2021-47918

CVE.ORG link : CVE-2021-47918

JSON object : View

Products Affected

simplephpscripts

  • simple_cms_php
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')