Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
Get-simpleGetsimple Cms

11 matches found

CVE
CVE•added 2018/11/21 9:29 p.m.•52 views

CVE-2018-19420

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename), because of admin/upload-uploadify.php, and validate_safe_file in...

4CVSS4.4AI score0.00221EPSS
CVE
CVE•added 2014/05/14 7:55 p.m.•50 views

CVE-2014-1603

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php.

4.3CVSS5.8AI score0.03324EPSS
CVE
CVE•added 2018/11/21 9:29 p.m.•48 views

CVE-2018-19421

In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php.

4CVSS4.5AI score0.00221EPSS
CVE
CVE•added 2011/10/05 10:55 a.m.•42 views

CVE-2010-4863

Cross-site scripting (XSS) vulnerability in admin/changedata.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the post-title parameter.

4.3CVSS5.8AI score0.06321EPSS
CVE
CVE•added 2011/11/23 1:55 a.m.•40 views

CVE-2010-5052

Cross-site scripting (XSS) vulnerability in admin/components.php in GetSimple CMS 2.01 allows remote attackers to inject arbitrary web script or HTML via the val[] parameter.

4.3CVSS5.8AI score0.00425EPSS
CVE
CVE•added 2014/01/17 3:18 p.m.•38 views

CVE-2013-7243

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) post-menu field to edit.php or (2) Display name field to settings.php. NOTE: The Custom Permalink Structure and Email Address fields are alr...

4.3CVSS5.9AI score0.00475EPSS
CVE
CVE•added 2015/07/01 4:59 p.m.•37 views

CVE-2015-5355

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post-content or (2) post-title parameter to admin/edit.php.

4.3CVSS5.9AI score0.00296EPSS
CVE
CVE•added 2014/01/16 9:55 p.m.•36 views

CVE-2012-6621

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email Address or (2) Custom Permalink Structure fields in admin/settings.php; (3) path parameter to admin/upload.php; (4) err...

4.3CVSS5.9AI score0.00475EPSS
CVE
CVE•added 2015/07/01 4:59 p.m.•36 views

CVE-2015-5356

Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter.

4.3CVSS5.9AI score0.00296EPSS
CVE
CVE•added 2018/10/01 8:29 a.m.•32 views

CVE-2018-17835

An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI.

4.8CVSS4.7AI score0.00235EPSS
CVE
CVE•added 2018/08/25 9:29 p.m.•30 views

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field.

4.8CVSS4.8AI score0.00242EPSS