218 matches found
CVE-2021-28976
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...
Remote code execution
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...
Cross site scripting
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...
CVE-2021-28977
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...
CVE-2021-28977
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...
CVE-2021-28977
GetSimpleCMS 3.3.16 is affected by a cross-site scripting vulnerability in admin/upload.php. The issue arises from injecting comments or file header data into content stored in xla, pages, and gzip files, enabling XSS. Multiple connected sources (including Red Hat, CNVD/CNNVD, OSV, CVE registry) ...
CVE-2021-28977
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,...
CVE-2021-28976
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...
CVE-2021-28976
Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess...
CVE-2021-28976
CVE-2021-28976 affects GetSimpleCMS versions prior to 3.3.16, with a remote code execution vulnerability in admin/upload.php exploitable through PHAR file uploads. The connected sources confirm a phar-based attack chain leading to RCE (e.g., PoCs and exploits in Exploit-DB/PacketStorm) and indica...
PT-2021-10486
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS version 3.4.0a Description: A Cross Site Scripting XSS issue exists in the admin/edit.php file. Recommendations: For GetSimpleCMS version 3.4.0a, update to a newer version that contains a fix for this issue...
CVE-2020-18659: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in GetSimpleCMS =3.3.15 via the 1 sitename, 2 username, and 3 email parameters to /admin/setup.php...
PT-2021-10199
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions 3.3.15 and earlier Description: The issue is related to an open redirect in the admin/changedata.php file via the redirect function to the url parameter. This allows for potential redirection to unintended locations...
PT-2021-18011
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions prior to 3.3.16 Description: The issue is related to a Remote Code Execution vulnerability. It affects the admin/upload.php file through phar files. Recommendations: For versions prior to 3.3.16, update to version 3.3.16...
PT-2021-10196
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions 3.3.15 and earlier Description: A Cross Site Scripting XSS issue exists due to the redirect url parameter in admin/changedata.php and the headers sent function. This allows for potential exploitation. Recommendations: Fo...
PT-2021-10198
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions prior to 3.3.16 Description: A Cross Site Scripting issue exists due to improper validation of user input in the sitename, username, and email parameters to the "/admin/setup.php" API endpoint. This allows an attacker to...
CVE-2020-20389: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php...
CVE-2020-18657: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in GetSimpleCMS = 3.3.15 in admin/changedata.php via the redirecturl parameter and the headerssent function...