CVE-2021-29400

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change the SMTP settings of the contact forms for the webpages of the CMS after an authenticated admin visits a malicious third-party site.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://get-simple.info/extend/plugin/my-smtp-contact/1221/Exploit, Third Party Advisory
http://get-simple.info/extend/plugin/my-smtp-contact/1221/Exploit, Third Party Advisory

Timeline

Published: Aug 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-294146.1STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control.CVE-2021-294155.5The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor CVE-2021-294166.5An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipulated into issuing a CVE-2021-294179.8gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.CVE-2021-294185.3The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9. CVE-2021-294217.5models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.CVE-2021-294247.5The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address strin CVE-2021-294254.8In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\f CVE-2021-294277.2In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poison CVE-2021-294287.8In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple CVE-2021-294295.5In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access informat CVE-2021-294307.5Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user cou