Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
53 results · page 1 of 2
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-71542 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.7
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/components.php) via the title parameter. The stored title is rendered inside a double-quoted HTML attribute in the administrative interface through an output path that HTML-entity-decodes the value before printing it, without re-encoding for the attribute context. This allows persistent execution of arbitrary JavaScript in the admin panel. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-71426 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 7.1
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. On the public front-end, this value is passed unsanitized to a PHP include() when the page is rendered. Because the include path is never confined, this allows directory-traversal Local File Inclusion: arbitrary local files are included (and, if they contain PHP, executed) when any visitor requests the page. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-70650 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.8
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the page backup viewer (admin/backup-edit.php). Page fields are correctly HTML-encoded when a page is saved, but the backup viewer decodes them again (htmldecode() / strip_decode()) and prints the result without re-escaping. A user who can edit a page can store JavaScript in a page's Keywords, Description, Menu text or Content; it executes in the browser of any administrator who later views that page's backup, in the context of the admin control panel. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-56662 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.6
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that auto-submits a forged POST to the update endpoint; when an authenticated administrator visits it, the server performs an attacker-directed download-and-deploy operation in the administrator's session — with no further interaction. Because the deployed content is executed (see the related ZIP-extraction advisory), this yields remote code execution. The url field is additionally written into the form unescaped, providing a secondary HTML-injection sink via a malicious upgrade.json. This issue has been patched in version 1.5.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-56661 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 7.5
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destinations, including internal-only services and cloud metadata endpoints (169.254.169.254). The fetched response body is written to a web-accessible file (/Tmpfile.zip) and is not deleted when the content is not a valid ZIP, turning this into a full-read SSRF: the attacker can retrieve the response of the internal request directly. This issue has been patched in version 1.5.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-56660 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.1
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended extraction directory. This issue has been patched in version 1.5.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-53953 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.1
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the application generates a new temporary password and immediately stores its hash as the user's new password. The temporary password is generated using PHP rand() seeded with microtime(). Because this seed is time-based and has a limited effective search space, an attacker can generate possible reset password candidates. Since the admin login endpoint does not enforce rate limiting or account lockout, these candidates can be tested online until the correct password is found. Successful exploitation may lead to administrator account takeover. At time of publication, there are no publicly available patches.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS.CVE-2026-53952 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.8
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026GetSimple CMS is a content management system.CVE-2026-28495 · Other software · GetSimpleCMS-CE · reported by GitHubCritical 9.6
GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. The form lacks CSRF protection, enabling a remote unauthenticated attacker to exploit this via Cross-Site Request Forgery against a logged-in admin, achieving Remote Code Execution (RCE) on the web server.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GetSimple CMS is a content management system.CVE-2026-27202 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.8
GetSimple CMS is a content management system. All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file reads. This issue has not been fixed at the time of publication.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GetSimple CMS is a content management system.CVE-2026-27161 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.7
GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments), these protections are silently ignored, allowing unauthenticated attackers to list and download sensitive files including authorization.xml, which contains cryptographic salts and API keys. This issue does not have a fix at the time of publication.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GetSimple CMS is a content management system.CVE-2026-27147 · Other software · GetSimpleCMS-CE · reported by GitHubMedium 6.9
GetSimple CMS is a content management system. All versions of GetSimple CMS are vulnerable to XSS through SVG file uploads. Authenticated users can upload SVG files via the administrative upload functionality, but they are not properly sanitized or restricted, allowing an attacker to embed malicious JavaScript. When the uploaded SVG file is accessed, the script executes in the browser. This issue does not have a fix at the time of publication.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026GetSimple CMS is a content management system.CVE-2026-27146 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 7.1
GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoint. As a result, an attacker can craft a malicious web page that silently triggers a file upload request from an authenticated victim’s browser. The request is accepted without requiring a CSRF token or origin validation. This allows an attacker to upload arbitrary files to the application without the victim’s knowledge or consent. In order to exploit this vulnerability, the victim must be authenticated to GetSimple CMS (e.g., admin user), and visit an attacker-controlled webpage. This issue does not have a fix at the time of publication.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2026GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability.CVE-2021-47870 · Other software · GetSimple CMS · reported by VulnCheckMedium 4.8
GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize user input using htmlspecialchars(), but this can be bypassed by passing dangerous characters as escaped hex bytes. This allows attackers to inject arbitrary client-side code that executes in the administrator's browser when visiting a malicious page.
- Product
- My SMTP Contact Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordget-simple.infogithub.com
Jan 21, 2026GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side codCVE-2021-47860 · Other software · GetSimple CMS · reported by VulnCheckHigh 8.5
GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote code on the hosting server when an authenticated administrator visits the page.
- Product
- Custom JS Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordget-simple.infogithub.com
Jan 21, 2026GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability.CVE-2021-47830 · Other software · GetSimple CMS · reported by VulnCheckMedium 5.1
GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, can change SMTP configuration settings in the plugin. This may allow unauthorized changes but does not directly enable remote code execution.
- Product
- My SMTP Contact Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordget-simple.infogithub.com
Jan 21, 2026GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability.CVE-2021-47778 · Other software · Get-Simple · reported by VulnCheckHigh 8.6
GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server.
- Product
- My SMTP Contact Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordget-simple.infogithub.com
Jul 25, 2025An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1.CVE-2013-10032 · Other software · GetSimple CMS Project · reported by VulnCheckHigh 8.7
An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authenticated users to upload arbitrary files without proper validation of MIME types or extensions. By uploading a .pht file containing PHP code, an attacker can bypass blacklist-based restrictions and place executable code within the web root. A crafted request using a polyglot or disguised extension allows the attacker to execute the payload by accessing the file directly via the web server. This vulnerability exists due to the use of a blacklist for filtering file types instead of a whitelist.
- Product
- GetSimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordget-simple.inforaw.githubusercontent.com
May 30, 2025GetSimple CMS is a content management system.CVE-2025-48492 · Other software · GetSimpleCMS-CE · reported by GitHubHigh 8.6
GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can inject arbitrary PHP into a component file and execute it via a crafted query string, resulting in Remote Code Execution (RCE). This issue is set to be patched in version 3.3.22.
- Product
- GetSimpleCMS-CE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2024GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module.CVE-2024-55088 · Other software · Getsimple-ce · reported by MITREHigh 8.8
GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) in the backend plugin module.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetsimple-ce.ovhtasteful-stamp-da4.notion.site
Dec 18, 2024In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management sysCVE-2024-55086 · Other software · Getsimple-ce · reported by MITREHigh 7.2
In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management system.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetsimple-ce.ovhtasteful-stamp-da4.notion.site
Dec 16, 2024GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attaCVE-2024-55085 · Other software · Getsimple-ce · reported by MITRECritical 9.8
GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetsimple-ce.ovhtasteful-stamp-da4.notion.site
Jan 8, 2024A Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php CVE-2023-51246 · Other software · Get-simple · reported by MITREMedium 5.4
A Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page.
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 18, 2022GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php.CVE-2022-41544 · Other software · Get-simple · reported by MITRECritical 9.8
GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 27, 2022A vulnerability, which was classified as problematic, has been found in GetSimple CMS.CVE-2022-1503 · Other software · GetSimple · reported by VulDBLow 3.5
A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like <script>alert(1)</script> leads to cross site scripting. The attack may be launched remotely but requires authentication. Expoit details have been disclosed within the advisory.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2021A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change the SMTP settings of CVE-2021-29400 · Other software · Netexplorer · reported by MITREMedium 6.5
A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change the SMTP settings of the contact forms for the webpages of the CMS after an authenticated admin visits a malicious third-party site.
- Product
- MY Smtp Contact
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordget-simple.infoget-simple.info
Aug 6, 2021A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via cCVE-2020-21353 · Other software · Get-simple · reported by MITREMedium 5.4
A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module.
- Product
- Getsimplecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2020GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new pageCVE-2020-24861 · Other software · Get-simple · reported by MITREMedium 5.4
GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordget-simple.infoexploit-db.com
Sep 25, 2020A Cross-Site Request Forgery (CSRF) vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin (or other) users after aCVE-2020-23837 · Other software · Multi User Project · reported by MITREHigh 8.8
A Cross-Site Request Forgery (CSRF) vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin (or other) users after an authenticated admin visits a third-party site or clicks on a URL.
- Product
- Multi User
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordget-simple.infoexploit-db.com
Sep 1, 2020A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JCVE-2020-23839 · Other software · Get-simple · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 2, 2020Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id pCVE-2013-1420 · Other software · Get-simple · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to filebrowser.php in admin/. NOTE: the path parameter in admin/upload.php vector is already covered by CVE-2012-6621.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comget-simple.info
Sep 15, 2019GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.CVE-2019-16333 · Other software · Get-simple · reported by MITREMedium 5.4
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2019An issue was discovered in GetSimple CMS through 3.3.15.CVE-2019-11231 · Other software · Get-simple · reported by MITRECritical 9.8
An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content (PHP code, for example). This vulnerability is triggered by an authenticated user; however, authentication can be bypassed. According to the official documentation for installation step 10, an admin is required to upload all the files, including the .htaccess files, and run a health check. However, what is overlooked is that the Apache HTTP Server by default no longer enables the AllowOverride directive, leading to data/users/admin.xml password exposure. The passwords are hashed but this can be bypassed by starting with the data/other/authorization.xml API key. This allows one to target the session state, since they decided to roll their own implementation. The cookie_name is crafted information that can be leaked from the frontend (site name and version). If a someone leaks the API key and the admin username, then they can bypass authentication. To do so, they need to supply a cookie based on an SHA-1 computation of this known information. The vulnerability exists in the admin/theme-edit.php file. This file checks for forms
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comssd-disclosure.com
Dec 31, 2018There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a related issue to CVE-2018-16325.CVE-2018-19845 · Other software · Get-simple · reported by MITREMedium 5.4
There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a related issue to CVE-2018-16325.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2018In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, CVE-2018-19421 · Other software · Get-simple · reported by MITRELow 3.8
In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2018In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no exteCVE-2018-19420 · Other software · Get-simple · reported by MITRELow 3.8
In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename), because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2018An issue was discovered in GetSimple CMS 3.3.15.CVE-2018-17835 · Other software · Get-simple · reported by MITREMedium 4.8
An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2018An issue was discovered in GetSimple CMS v3.3.13.CVE-2018-17103 · Other software · Get-simple · reported by MITREHigh 8.8
An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2018There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.CVE-2018-16325 · Other software · Get-simple · reported by MITREMedium 6.1
There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2018GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.CVE-2018-15843 · Other software · Get-simple · reported by MITREMedium 4.8
GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2018Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web scCVE-2018-9173 · Other software · Get-simple · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web script or HTML, as demonstrated by the movieName parameter.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jun 29, 2017admin/profile.php in GetSimple CMS 3.x has XSS in a name field.CVE-2017-10673 · Other software · Get-simple · reported by MITREMedium 6.1
admin/profile.php in GetSimple CMS 3.x has XSS in a name field.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2017Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrCVE-2017-8081 · Other software · Cagintranetworks · reported by MITREHigh 8.8
Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 17, 2017GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) plugins/anonymous_data.php or (2) plugins/InnovationPlugCVE-2014-8723 · Other software · Get-simple · reported by MITREMedium 5.3
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) plugins/anonymous_data.php or (2) plugins/InnovationPlugin.php, which reveals the installation path in an error message.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrossmarks.ukrossmarks.uk
Mar 17, 2017GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.CVE-2014-8722 · Other software · Get-simple · reported by MITREHigh 7.5
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3) data/other/authorization.xml, or (4) data/other/appid.xml.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comrossmarks.uk
Jul 1, 2015Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML vCVE-2015-5356 · Other software · Get-simple · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2015Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) postCVE-2015-5355 · Other software · Get-simple · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post-content or (2) post-title parameter to admin/edit.php.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jan 20, 2015XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remoteCVE-2014-8790 · Other software · Cagintranetworks · reported by MITREMedium 5
XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordget-simple.infokarmainsecurity.com
May 14, 2014Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param paramCVE-2014-1603 · Other software · Get-simple · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Jan 17, 2014Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pCVE-2013-7243 · Other software · Get-simple · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) post-menu field to edit.php or (2) Display name field to settings.php. NOTE: The Custom Permalink Structure and Email Address fields are already covered by CVE-2012-6621.
- Product
- Getsimple CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgpacketstormsecurity.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.