GetSimpleCMS-CE vulnerabilities
We track 12 vulnerabilities in GetSimpleCMS-CE products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on October 1, 2026.
Latest GetSimpleCMS-CE vulnerabilities
- 8.7 High severity
GetSimpleCMS-CE: Improper Neutralization of Input During Web Page Generation
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, GetSimpleCMS-CE is vulnerable to stored Cross-Site Scripting (XSS) in the "Theme to Components" functionality (admin/co
- 7.1 High severity
GetSimpleCMS-CE: Improper Limitation of a Pathname to a Restricted Directory
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute. O
- 8.8 High severity
GetSimpleCMS-CE: Improper Neutralization of Input During Web Page Generation
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the page backup viewer (admin/backup-edit.ph
- 9.6 Critical severity
GetSimpleCMS-CE: Cross-Site Request Forgery
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification.
- 7.5 High severity
GetSimpleCMS-CE: Server-Side Request Forgery
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — th
- 9.1 Critical severity
GetSimpleCMS-CE: Cross-Site Request Forgery
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file
- 9.1 Critical severity
GetSimpleCMS-CE: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the ap
- 9.8 Critical severity
GetSimpleCMS-CE: Improper Authorization
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administra
- 8.8 High severity
GetSimpleCMS-CE: Cross-Site Request Forgery
GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. T
- 7.5 High severity
GetSimpleCMS-CE: Improper Limitation of a Pathname to a Restricted Directory
GetSimple CMS is a content management system. All versions of GetSimple CMS have a flaw in the Uploaded Files feature that allows for arbitrary file reads. This issue has not been fixed at the time of publication.
- 7.5 High severity
GetSimpleCMS-CE: Exposure of Sensitive Information to an Unauthorized Actor
GetSimple CMS is a content management system. All versions of GetSimple CMS rely on .htaccess files to restrict access to sensitive directories such as /data/ and /backups/. If Apache AllowOverride is disabled (common in hardened or shared hosting environments
- 8.8 High severity
GetSimpleCMS-CE: Improper Neutralization of Special Elements used in a Command
GetSimple CMS is a content management system. In versions starting from 3.3.16 to 3.3.21, an authenticated user with access to the Edit component can inject arbitrary PHP into a component file and execute it via a crafted query string, resulting in Remote Code