8 matches found
CVE-2026-56662 GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...
EUVD-2026-91018
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...
CVE-2026-56662 GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...
CVE-2026-56662
GetSimple CMS CE versions prior to 1.5 are vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of anti-CSRF tokens and missing request-origin verification in the UpdateCE update form. A remote attacker can trick an authenticated administrator into visiting a malicious page that...
CVE-2026-56661 GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with filegetcontents after only format validation FILTERVALIDATEURL — there is no validation of the request destination...
CVE-2026-56661 GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with filegetcontents after only format validation FILTERVALIDATEURL — there is no validation of the request destination...
CVE-2026-56662: Cross-Site Request Forgery (CSRF)
GetSimple CMS is a content management system CMS, and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that...
PT-2026-103991
Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 1.5 Description The UpdateCE update form lacks anti-CSRF tokens, and the POST handler does not verify tokens or request origins. This allows a remote attacker to host a page that auto-submits a forged POST reque...