CVE-2021-47736

CVE-2021-47736 is an authenticated remote code execution vulnerability affecting CMSimple_XH version 1.7.4. This flaw allows administrative users to upload malicious PHP files, specifically by exploiting the CSRF token mechanism to create a PHP shell for arbitrary command execution. With a CVSS score of 7.2 (HIGH), the vulnerability has a network attack vector and low attack complexity, enabling a high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.