Vendor
GetSimpleCMS-CE
15 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
Critical 9.6
GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification.…
-
Critical 9.1
GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file…
-
Critical 9.1
GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the password reset endpoint can be accessed without authentication. When a reset request is submitted for an existing user, the a…
-
Critical 9.8
GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administr…
-
Critical 9.7
GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php
GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. …