High severity8.8NVD Advisory· Published May 8, 2023· Updated Jun 17, 2026

CVE-2021-28999

Description

SQL Injection vulnerability in CMS Made Simple through 2.2.15 allows remote attackers to execute arbitrary commands via the m1_sortby parameter to modules/News/function.admin_articlestab.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cmsmadesimple/Cmsmadesimple
cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*
Range: <=2.2.15
CMS Made Simple/CMS Made Simpledescription
Simple CMS/Simple CMSllm-fuzzy
Range: <=2.2.15

Patches

Vulnerability mechanics

References

github.com/beerpwn/CVE/blob/master/cms_made_simple_2021/sqli_order_by/CMS-MS-SQLi-report.mdnvdExploit
seclists.org/fulldisclosure/2021/Mar/49nvdMailing ListThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000