Advisories · Technology
GetSimpleCMS-CE.
Every CVE that names GetSimpleCMS-CE among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.7 High
GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php
- GetSimpleCMS-CE
- Cross-site scripting (XSS)
- CVSS 7.1 High
GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field
- GetSimpleCMS-CE
- Path traversal
- File inclusion
- CVSS 8.8 High
GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content
- GetSimpleCMS-CE
- Cross-site scripting (XSS)
- CVSS 9.6 CriticalCritical · CVSS 9+
GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request
- GetSimpleCMS-CE
- Cross-site request forgery (CSRF)
- CVSS 7.5 High
GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint
- GetSimpleCMS-CE
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
- GetSimpleCMS-CE
- Cross-site request forgery (CSRF)
- Unrestricted file upload
- CVSS 9.1 CriticalCritical · CVSS 9+
GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover
- GetSimpleCMS-CE
- Weak cryptography or TLS
- CWE-640
- CVSS 9.8 CriticalCritical · CVSS 9+
GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
- GetSimpleCMS-CE
- GetSimpleCMS
- Broken access control
- Authentication bypass
- CVSS 9.7 CriticalCritical · CVSS 9+
GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php
- GetSimpleCMS-CE
- Cross-site request forgery (CSRF)
- CVSS 4.8 Medium
GetSimpleCMS-CE < 3.3.22 Stored XSS via components.php
- GetSimpleCMS-CE
- Cross-site scripting (XSS)
- CVSS 8.8 High
GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability
- GetSimpleCMS-CE
- Path traversal
- CVSS 8.7 High
Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories
- GetSimpleCMS-CE
- Information disclosure
- CVSS 6.9 Medium
GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated)
- GetSimpleCMS-CE
- Cross-site scripting (XSS)
- CVSS 7.1 High
GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads
- GetSimpleCMS-CE
- Cross-site request forgery (CSRF)
- Unrestricted file upload
- CVSS 8.6 High
GetSimple CMS RCE in Edit component
- GetSimpleCMS-CE
- Command injection