EUVD-2026-84857

CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection into a no-op on every state-changing admin request, and it does not send the csrftoken hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an...

CVE-2026-88418

CMSimple 5.24 is vulnerable to persistent remote code execution (RCE) due to disabled CSRF protection by default. The csrfProtection() function acts as a no-op on state-changing admin requests, and the csrf_token hidden field is missing from admin forms. Since authentication is cookie-only, an un...