CVE-2021-47917
Last modified
CVE-2021-47917 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Simple CMS 2.1 contains a persistent cross-site scripting vulnerability in user input parameters that allows remote attackers to inject malicious script code. Attackers can exploit the newUser and editUser modules to inject persistent scripts that execute on user list preview, potentially leading to session hijacking and application manipulation.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Simple CMS 2.1 contains a persistent cross-site scripting vulnerability in user input parameters that allows remote attackers to inject malicious script code. Attackers can exploit the newUser and editUser modules to inject persistent scripts that execute on user list preview, potentially leading to session hijacking and application manipulation.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Simplephpscripts | Simple Cms Php | 2.1 |
References
- https://www.vulnerability-lab.com/get_content.php?id=2302Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2021-47917?
How severe is CVE-2021-47917?
How do I fix CVE-2021-47917?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-47911Affiliate Pro 1.7 contains multiple reflected cross-site scr…5.4
- CVE-2021-47912PHP Melody version 3.0 contains multiple non-persistent cros…5.4
- CVE-2021-47913PHP Melody 3.0 contains a persistent cross-site scripting vu…5.4
- CVE-2021-47914PHP Melody version 3.0 contains a persistent cross-site scri…5.4
- CVE-2021-47915PHP Melody version 3.0 contains a remote SQL injection vulne…8.8
- CVE-2021-47916Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2021-47918Simple CMS 2.1 contains a remote SQL injection vulnerability…8.8
- CVE-2021-47919Simple CMS 2.1 contains a non-persistent cross-site scriptin…5.4
- CVE-2021-47920WebMO Job Manager 20.0 contains a cross-site scripting vulne…5.4
- CVE-2021-47921Free Photo & Video Vault 0.0.2 contains a directory traversa…7.1
- CVE-2021-47922Slider by Soliloquy 2.6.2 contains a stored cross-site scrip…6.4
- CVE-2021-47923OpenCart 3.0.3.8 contains a session fixation vulnerability t…9.8
Are you affected by CVE-2021-47917?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST