Description
CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inject malicious scripts by encoding payloads like ')-alert(1)// and execute arbitrary JavaScript when victims interact with delete buttons.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cmsimple | CMSimple | <=5.4 | — |
References
- ExploitDB-50612 exploit
- CMSimple Official Homepage product
- VulnCheck Advisory: CMSimple 5.4 Cross-Site Scripting via HTML Unicode Encoding third-party-advisory