High severity8.8NVD Advisory· Published Dec 10, 2025· Updated Jun 17, 2026

CVE-2024-58280

Description

CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensions_userfiles and upload a shell script to the media directory to execute arbitrary code on the server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cmsimple/Cmsimple3 versions
cpe:2.3:a:cmsimple:cmsimple:5.15:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:cmsimple:cmsimple:5.15:*:*:*:*:*:*:*
- (no CPE)range: =5.15
- (no CPE)range: 5.15

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/52040nvdExploit
www.vulncheck.com/advisories/cmsimple-remote-command-execution-via-extensions-configurationnvdThird Party Advisory
www.cmsimple.orgnvdProduct
www.cmsimple.org/downloads_cmsimple50/CMSimple_5-15.zipnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000