CVE-2021-42645

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker must use the "File" parameter to upload a PHP payload to get a reverse shell from the vulnerable host.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Net-hunter121/CMSimple_XH-Unauth-RCEExploit, Third Party Advisory
https://github.com/cmsimple-xh/cmsimple-xh/releases/tag/1.7.5Release Notes, Third Party Advisory
https://github.com/Net-hunter121/CMSimple_XH-Unauth-RCEExploit, Third Party Advisory
https://github.com/cmsimple-xh/cmsimple-xh/releases/tag/1.7.5Release Notes, Third Party Advisory

Timeline

Published: May 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-426469.1XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.CVE-2021-426486.1Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted U CVE-2021-42656.1A vulnerability was found in siwapp-ror. It has been rated as problematic. This issue affects some unknown processing. The manipulation lead CVE-2021-426506.1Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.CVE-2021-426518.8A Server Side Template Injection (SSTI) vulnerability in Pentest-Collaboration-Framework v1.0.8 allows an authenticated remote attacker to e CVE-2021-426549.8SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be used to execute arbitra CVE-2021-426558.8SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.CVE-2021-426565.4SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-426596.5There is a buffer overflow vulnerability in the Web server httpd of the router in Tenda router devices such as Tenda AC9 V1.0 V15.03.02.19(6 CVE-2021-42666.1A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file cor CVE-2021-426625.4A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the CVE-2021-426634.3An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /