CVE-2021-42645

Published: May 10, 2022Modified: Jun 17, 2026

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: NVD

Description

CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker must use the "File" parameter to upload a PHP payload to get a reverse shell from the vulnerable host.

Affected (1)

Products: Cmsimple Xh: Cmsimple Xh

Cmsimple Xh

1 product

Cmsimple Xh

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cmsimple Xh Cmsimple Xh	Version 1.7.4

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

https://github.com/Net-hunter121/CMSimple_XH-Unauth-RCE

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/cmsimple-xh/cmsimple-xh/releases/tag/1.7.5

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/Net-hunter121/CMSimple_XH-Unauth-RCE

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/cmsimple-xh/cmsimple-xh/releases/tag/1.7.5

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

Timeline

No history available yet.