Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
Get-simpleGetsimple Cms

26 matches found

CVE
CVE•added 2019/05/22 6:29 p.m.•110 views

CVE-2019-11231

An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content (PHP code, for example). This vulnerability is triggered by an authenticated user; however, authentication can be bypassed. According to th...

9.8CVSS9.6AI score0.61684EPSS
CVE
CVE•added 2022/10/18 3:15 p.m.•93 views

CVE-2022-41544

GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php.

9.8CVSS9.8AI score0.64323EPSS
CVE
CVE•added 2020/01/02 9:15 p.m.•92 views

CVE-2013-1420

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to filebrowser.php in admin...

6.1CVSS5.9AI score0.00475EPSS
CVE
CVE•added 2017/03/17 2:59 p.m.•78 views

CVE-2014-8722

GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3) data/other/authorization.xml, or (4) data/other/appid.xml.

7.5CVSS7.2AI score0.33791EPSS
CVE
CVE•added 2020/09/01 5:15 p.m.•75 views

CVE-2020-23839

A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...

6.1CVSS6AI score0.14038EPSS
CVE
CVE•added 2019/09/15 10:15 p.m.•73 views

CVE-2019-16333

GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.

5.4CVSS5.3AI score0.00206EPSS
CVE
CVE•added 2018/11/21 9:29 p.m.•52 views

CVE-2018-19420

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename), because of admin/upload-uploadify.php, and validate_safe_file in...

4CVSS4.4AI score0.00221EPSS
CVE
CVE•added 2014/05/14 7:55 p.m.•50 views

CVE-2014-1603

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php.

4.3CVSS5.8AI score0.03324EPSS
CVE
CVE•added 2018/11/21 9:29 p.m.•48 views

CVE-2018-19421

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php.

4CVSS4.5AI score0.00221EPSS
CVE
CVE•added 2018/04/02 3:29 a.m.•45 views

CVE-2018-9173

Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web script or HTML, as demonstrated by the movieName parameter.

6.1CVSS5.9AI score0.005EPSS
CVE
CVE•added 2011/10/05 10:55 a.m.•42 views

CVE-2010-4863

Cross-site scripting (XSS) vulnerability in admin/changedata.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the post-title parameter.

4.3CVSS5.8AI score0.06321EPSS
CVE
CVE•added 2022/04/27 8:15 a.m.•41 views

CVE-2022-1503

A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like <script>alert(1)</script> leads to cross site scripting. The ...

5.4CVSS4.5AI score0.00175EPSS
CVE
CVE•added 2011/11/23 1:55 a.m.•40 views

CVE-2010-5052

Cross-site scripting (XSS) vulnerability in admin/components.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the val[] parameter.

4.3CVSS5.8AI score0.00425EPSS
CVE
CVE•added 2018/09/16 9:29 p.m.•39 views

CVE-2018-17103

An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter

8.8CVSS8.7AI score0.00141EPSS
CVE
CVE•added 2014/01/17 3:18 p.m.•38 views

CVE-2013-7243

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) post-menu field to edit.php or (2) Display name field to settings.php. NOTE: The Custom Permalink Structure and Email Address fields are alr...

4.3CVSS5.9AI score0.00475EPSS
CVE
CVE•added 2015/01/20 3:59 p.m.•38 views

CVE-2014-8790

XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter.

5CVSS6.9AI score0.00657EPSS
CVE
CVE•added 2015/07/01 4:59 p.m.•37 views

CVE-2015-5355

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post-content or (2) post-title parameter to admin/edit.php.

4.3CVSS5.9AI score0.00296EPSS
CVE
CVE•added 2014/01/16 9:55 p.m.•36 views

CVE-2012-6621

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email Address or (2) Custom Permalink Structure fields in admin/settings.php; (3) path parameter to admin/upload.php; (4) err...

4.3CVSS5.9AI score0.00475EPSS
CVE
CVE•added 2015/07/01 4:59 p.m.•36 views

CVE-2015-5356

Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter.

4.3CVSS5.9AI score0.00296EPSS
CVE
CVE•added 2018/09/01 10:29 p.m.•36 views

CVE-2018-16325

There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.

6.1CVSS5.5AI score0.00223EPSS
CVE
CVE•added 2017/06/29 8:29 a.m.•34 views

CVE-2017-10673

admin/profile.php in GetSimple CMS 3.x has XSS in a name field.

6.1CVSS5.9AI score0.0024EPSS
CVE
CVE•added 2018/10/01 8:29 a.m.•32 views

CVE-2018-17835

An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI.

4.8CVSS4.7AI score0.00235EPSS
CVE
CVE•added 2020/10/01 2:15 p.m.•31 views

CVE-2020-24861

GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page

5.4CVSS5.3AI score0.00353EPSS
CVE
CVE•added 2018/08/25 9:29 p.m.•30 views

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.

4.8CVSS4.8AI score0.00242EPSS
CVE
CVE•added 2018/12/31 3:29 p.m.•29 views

CVE-2018-19845

There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a related issue to CVE-2018-16325.

5.4CVSS5.5AI score0.00223EPSS
CVE
CVE•added 2017/03/17 2:59 p.m.•27 views

CVE-2014-8723

GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) plugins/anonymous_data.php or (2) plugins/InnovationPlugin.php, which reveals the installation path in an error message.

5.3CVSS5.1AI score0.00261EPSS