CVE-2011-0635: Simploo CMS

Medium severity, CVSS 6.0. EPSS: 1.9% chance of exploitation in the next 30 days.

Static code injection vulnerability in Simploo CMS 1.7.1 and earlier allows remote authenticated users to inject arbitrary PHP code into config/custom/base.ini.php via the ftpserver parameter (FTP-Server field) to the sicore/updates/optionssav operation for index.php.

Affected products

• Simploo Simploo CMS: up to and including 1.7.1; version 1.2.0 only; version 1.3.0 only; version 1.5.0 only; version 1.5.2 only; version 1.7.0 only

Published 2011-01-22. Last modified 2026-06-16.