https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-47736.htmlhttps://patchthecve.com/cve/CVE-2021-47736.htmlWed, 17 Jun 2026 04:18:23 +0000HIGH 7.2: CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload malicious PHP files. Attackers with valid credentials can exploit the CSRF token mechanism to create a PHP shell file that enables arbitraryhttps://patchthecve.com/cve/CVE-2025-63589.htmlhttps://patchthecve.com/cve/CVE-2025-63589.htmlWed, 17 Jun 2026 09:53:16 +0000HIGH 7.1: A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the https://patchthecve.com/cve/CVE-2025-63588.htmlhttps://patchthecve.com/cve/CVE-2025-63588.htmlWed, 17 Jun 2026 09:53:16 +0000HIGH 7.1: An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a maliciously crafted POST login). Successful exploitation may lead to theft of sehttps://patchthecve.com/cve/CVE-2024-34452.htmlhttps://patchthecve.com/cve/CVE-2024-34452.htmlWed, 17 Jun 2026 07:33:26 +0000MEDIUM 6.1: CMSimple_XH 1.7.6 allows XSS by uploading a crafted SVG document.