CVE-2021-47778 - Vulnerability Details - OpenCVE

GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://get-simple.info
https://github.com/GetSimpleCMS/GetSimpleCMS
https://github.com/boku7/gsSMTP-Csrf2Xss2RCE/
https://www.exploit-db.com/exploits/49774
https://www.vulncheck.com/advisories/getsimple-cms-my-smtp-contact-plugin-php-code-injection

History

Thu, 22 Jan 2026 02:45:00 +0900

Type	Values Removed	Values Added
Description		GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.
Title		GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection
Weaknesses		CWE-94
References		http://get-simple.info https://github.com/GetSimpleCMS/GetSimpleCMS https://github.com/boku7/gsSMTP-Csrf2Xss2RCE/ https://www.exploit-db.com/exploits/49774 https://www.vulncheck.com/advisories/getsimple-cms-my-smtp-contact-plugin-php-code-injection
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-01-21T17:29:48.390Z

Updated: 2026-01-21T17:29:48.390Z

Reserved: 2026-01-14T14:39:44.737Z

Link: CVE-2021-47778

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-01-21T18:16:09.250

Modified: 2026-01-21T18:16:09.250

Link: CVE-2021-47778

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-94

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2021-47778", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-14T14:39:44.737Z", "datePublished": "2026-01-21T17:29:48.390Z", "dateUpdated": "2026-01-21T17:29:48.390Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-01-21T17:29:48.390Z"}, "title": "GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection", "descriptions": [{"lang": "en", "value": "GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements used in a Command ('PHP Code Injection')", "cweId": "CWE-94", "type": "CWE"}]}], "affected": [{"vendor": "Get-Simple", "product": "My SMTP Contact Plugin", "versions": [{"version": "1.1.2", "status": "affected"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "baseScore": 8.6, "baseSeverity": "HIGH"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/49774", "name": "ExploitDB-49774", "tags": ["exploit"]}, {"url": "http://get-simple.info", "name": "Vendor Homepage", "tags": ["product"]}, {"url": "https://github.com/GetSimpleCMS/GetSimpleCMS", "name": "GetSimple CMS GitHub Repository", "tags": ["product"]}, {"url": "https://github.com/boku7/gsSMTP-Csrf2Xss2RCE/", "name": "Full Disclosure Repository", "tags": ["technical-description", "exploit"]}, {"name": "VulnCheck Advisory: GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/getsimple-cms-my-smtp-contact-plugin-php-code-injection"}], "credits": [{"lang": "en", "value": "Bobby Cooke (boku)", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server."}], "id": "CVE-2021-47778", "lastModified": "2026-01-21T18:16:09.250", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-01-21T18:16:09.250", "references": [{"source": "disclosure@vulncheck.com", "url": "http://get-simple.info"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/GetSimpleCMS/GetSimpleCMS"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/boku7/gsSMTP-Csrf2Xss2RCE/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/49774"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/getsimple-cms-my-smtp-contact-plugin-php-code-injection"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}