Getsimple-ce vulnerabilities
We track 6 vulnerabilities in Getsimple-ce products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on March 10, 2026.
Latest Getsimple-ce vulnerabilities
- 8.8 High severity
GetSimpleCMS-CE: Cross-Site Request Forgery
GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. T
- 7.5 High severity
GetSimpleCMS-CE: Improper Limitation of a Pathname to a Restricted Directory
GetSimple CMS is a content management system. All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file reads. This issue has not been fixed at the time of publication.
- 7.5 High severity
GetSimpleCMS-CE: Exposure of Sensitive Information to an Unauthorized Actor
GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments
- 8.8 High severity
GetSimpleCMS-CE: Improper Neutralization of Special Elements used in a Command
GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can inject arbitrary PHP into a component file and execute it via a crafted query string, resulting in Remote Code
- 7.2 High severity
Getsimple CMS: Server-Side Request Forgery
In the GetSimple CMS CE 3.3.19 management page, Server-Side Request Forgery (SSRF) can be achieved in the plug-in download address in the backend management system.
- 9.8 Critical severity
Getsimple CMS: Improper Control of Generation of Code
GetSimple CMS CE 3.3.19 suffers from arbitrary code execution in the template editing function in the background management system, which can be used by an attacker to implement RCE.