Home

Description

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application.

PUBLISHED Reserved 2026-02-01 | Published 2026-02-01 | Updated 2026-02-02 | Assigner VulnCheck




HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
HIGH: 8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Problem types

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

2.1
affected

Credits

Vulnerability-Lab [Research Team] finder

References

www.vulnerability-lab.com/get_content.php?id=2303 (Vulnerability Lab Advisory) exploit

simplephpscripts.com/simple-cms-php (Product Homepage) product

www.vulncheck.com/...jection-vulnerability-via-users-module2 (VulnCheck Advisory: Simple CMS 2.1 SQL Injection Vulnerability via Users Module) third-party-advisory

cve.org (CVE-2021-47918)

nvd.nist.gov (CVE-2021-47918)

Download JSON