CVE-2024-58280: Cmsimple

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file extensions and upload malicious PHP files. Attackers can append ',php' to Extensions_userfiles and upload a shell script to the media directory to execute arbitrary code on the server.

Affected products

• Cmsimple Cmsimple: version 5.15 only

Published 2025-12-10. Last modified 2026-09-26.