CVE-2025-48492

GetSimple CMS is affected in versions 3.3.16–3.3.21. An authenticated user with access to the Edit component can inject arbitrary PHP into a component file and execute it via a crafted query string, resulting in Remote Code Execution (RCE). The issue is mitigated by upgrading to version 3.3.22, w...

CVE-2024-55085

CVE-2024-55085 affects GetSimple CMS CE 3.3.19. The issue is an arbitrary code execution in the template editing function of the backend management system, enabling remote code execution (RCE). Documented CVSSv3.1 base score 9.8 (CRITICAL) with network attack vector and no user interaction requir...

CVE-2024-55086

GetSimple CMS CE 3.3.19 is affected by a vulnerability where the plugin download address in the backend management page allows Server-Side Request Forgery (SSRF) . The root cause is tied to the plugin download mechanism in the management interface, enabling an attacker to induce requests from the...

CVE-2024-55088

CVE-2024-55088 affects GetSimple CMS CE 3.3.19 with a Server-Side Request Forgery (SSRF) in the backend plugin module . The CVSS 3.1 base score is 8.8 (HIGH) with network attack vector, low attack complexity, and privileges required, and impact to confidentiality, integrity, and availability (all...

CVE-2026-26351

CVE-2026-26351 affects GetSimpleCMS Community Edition 3.3.16. A stored XSS flaw exists in the Theme to Components workflow (components.php): user input in the component "slug" field is written to XML and later rendered in the admin interface without proper sanitization, enabling persistent script...

CVE-2026-27146

GetSimple CMS is affected by a CSRF on the administrative file upload endpoint across all versions due to missing CSRF protection. An attacker can craft a malicious page that silently triggers a file upload from an authenticated admin user’s browser without a token or origin validation, enabling ...

CVE-2026-27161

GetSimple CMS is affected: all versions rely on .htaccess to restrict access to /data/ and /backups/. If Apache AllowOverride is disabled, protections can be bypassed, allowing unauthenticated attackers to list and download sensitive files such as authorization.xml, which contains cryptographic s...

CVE-2026-27202

CVE-2026-27202 concerns GetSimple CMS. All versions are affected by a flaw in the Uploaded Files feature that enables arbitrary file reads. The issue is reported as not fixed at publication. The available documents do not provide exploit details or concrete attack vectors. The CVSS data indicates...

CVE-2026-28495

CVE-2026-28495 affects GetSimple CMS via the bundled massiveAdmin plugin in GetSimpleCMS-CE v3.3.22. The description states an authenticated administrator can overwrite the gsconfig.php configuration file with arbitrary PHP code through the gsconfig editor module, due to lack of CSRF protection. ...

CVE-2026-27147

GetSimple CMS is affected by a stored XSS due to unsanitized SVG uploads. All versions are vulnerable; authenticated users can upload SVG files via the admin upload function, and the uploaded SVGs execute JavaScript when viewed. The issue is described as not having a fix at the time of publicatio...