PT-2015-6863

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 3.3.6 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the func parameter in the admin/filebrowser.php file. Recommendations For versions prior to...

PT-2015-6862

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 3.3.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters are...

CVE-2015-5356: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter...

CVE-2015-5355: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 post-content or 2 post-title parameter to admin/edit.php...

GetSimple CMS 5.7.3.1 Cross Site Scripting

Date: 29/06/2015 Discovered by: Joel Vadodil Varghese Type of vulnerability: Persistent XSS Tested on: Windows 7 Product: GetSimple CMS Version: 5.7.3.1 Description: Application is vulnerable to Persistent XSS attack on page - URL -...

Cagintranet Networks GetSimple CMS Cross-Site Scripting Vulnerability

Cagintranet Networks GetSimple CMS is an XML-based content management system from Cagintranet Networks, USA. The system includes a theme selector and editor, a component editor, image and file managers, and more. A cross-site scripting vulnerability exists in Cagintranet Networks GetSimple CMS th...

CVE-2014-8790

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

Xxe

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

CVE-2014-8790

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

CVE-2014-8790

GetSimple CMS 3.1.1–3.3.x (before 3.3.5 Beta 1) is affected by an XML External Entity (XXE) vulnerability in admin/api.php. The issue arises from passing unsanitized POST data to simplexml_load_string(), enabling an attacker to disclose arbitrary files via the data parameter. Impact is consistent...

CVE-2014-8790

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

PT-2015-4081

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions 3.1.1 through 3.3.x Description The issue allows remote attackers to read arbitrary files via the data parameter in certain configurations. This is due to an XML external entity XXE vulnerability in the admin/api.php fil...

CVE-2014-8790: Undefined Security Weakness

XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...

GetSimple CMS 'api.php' XML External Entity Information Disclosure Vulnerability

GetSimple CMS is a content management system. GetSimple CMS suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information or launch further attacks...

GetSimple CMS 3.3.4 XML External Entity Injection Vulnerability

GetSimple CMS versions 3.1.1 through 3.3.4 suffer from an XML external entity injection vulnerability. ------------------------------------------------------------------ GetSimple CMS adddata$in; User input passed via the "data" POST parameter is not properly sanitized before being used in a call...

GetSimple CMS 3.3.4 XML External Entity Injection

------------------------------------------------------------------ GetSimple CMS adddata$in; User input passed via the "data" POST parameter is not properly sanitized before being used in a call to the "simplexmlloadstring" function at line 23. This can be exploited to carry out XML External Enti...

GetSimple CMS 3.3.1 - Cross-Site Scripting

GetSimple CMS 3.3.1 - Cross-Site Scripting PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1 CVE-2014-1603 by Pedro Ribeiro [email protected] from Agile Information Security Disclosure: 12/05/2014 / Last updated: 12/10/2014 Timeline: 04/11/2013 - Found bugs, produced proof of concept...

GetSimple CMS 3.3.1 - Cross-Site Scripting

PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1 CVE-2014-1603 by Pedro Ribeiro [email protected] from Agile Information Security Disclosure: 12/05/2014 / Last updated: 12/10/2014 Timeline: 04/11/2013 - Found bugs, produced proof of concept. 05/11/2013 - Communicated to the developer,...

GetSimpleCMS PHP File Upload Exploit

This Metasploit module exploits a file upload vulnerability in GetSimple CMS. By abusing the upload.php file, a malicious authenticated user can upload an arbitrary file, including PHP code, which results in arbitrary code execution. This module requires Metasploit: http//metasploit.com/download...

GetSimple CMS 2.01 and 2.02 Administrative Credentials Disclosure

No description provided by source. Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548...