CVE-2025-48492

GetSimple CMS is affected in versions 3.3.16–3.3.21. An authenticated user with access to the Edit component can inject arbitrary PHP into a component file and execute it via a crafted query string, resulting in Remote Code Execution (RCE). The issue is mitigated by upgrading to version 3.3.22, w...

CVE-2024-55085

GetSimple CMS CE version 3.3.19 is vulnerable to arbitrary code execution within the template editing function of the background management system. An attacker can exploit this flaw to achieve Remote Code Execution (RCE) . The vulnerability is categorized as Improper Control of Generation of Code...

CVE-2024-55086

The GetSimple CMS CE version 3.3.19 contains a Server-Side Request Forgery (SSRF) vulnerability within the plug-in download address in the backend management system. This flaw allows an attacker to trigger unauthorized server-side requests. As a temporary workaround, it is recommended to restrict...

CVE-2024-55088

GetSimple CMS CE version 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) within its backend plugin module . This flaw allows an attacker to forge requests originating from the server, which could lead to unauthorized access or actions. No specific exploit details or in-the-wild exploit...

CVE-2026-26351

CVE-2026-26351 affects GetSimpleCMS Community Edition 3.3.16. A stored XSS flaw exists in the Theme to Components workflow (components.php): user input in the component "slug" field is written to XML and later rendered in the admin interface without proper sanitization, enabling persistent script...

CVE-2026-27202

CVE-2026-27202 concerns GetSimple CMS. All versions are affected by a flaw in the Uploaded Files feature that enables arbitrary file reads. The issue is reported as not fixed at publication. The available documents do not provide exploit details or concrete attack vectors. The CVSS data indicates...

CVE-2026-27146

GetSimple CMS is affected by a CSRF on the administrative file upload endpoint across all versions due to missing CSRF protection. An attacker can craft a malicious page that silently triggers a file upload from an authenticated admin user’s browser without a token or origin validation, enabling ...

CVE-2026-27161

GetSimple CMS is affected: all versions rely on .htaccess to restrict access to /data/ and /backups/. If Apache AllowOverride is disabled, protections can be bypassed, allowing unauthenticated attackers to list and download sensitive files such as authorization.xml, which contains cryptographic s...

CVE-2026-28495

CVE-2026-28495 affects GetSimple CMS via the bundled massiveAdmin plugin in GetSimpleCMS-CE v3.3.22. The description states an authenticated administrator can overwrite the gsconfig.php configuration file with arbitrary PHP code through the gsconfig editor module, due to lack of CSRF protection. ...

CVE-2026-27147

GetSimple CMS is affected by a stored XSS due to unsanitized SVG uploads. All versions are vulnerable; authenticated users can upload SVG files via the admin upload function, and the uploaded SVGs execute JavaScript when viewed. The issue is described as not having a fix at the time of publicatio...