Getsimplecms-ce vulnerabilities

Products

• Getsimplecms-ce 15

Newest

• getsimplecms-ce GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php CVE-2026-71542 8.7 HighOctober 1, 2026
• getsimplecms-ce GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field CVE-2026-71426 7.1 HighOctober 1, 2026
• getsimplecms-ce GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content CVE-2026-70650 8.8 HighOctober 1, 2026
• getsimplecms-ce GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request CVE-2026-56662 9.6 CriticalOctober 1, 2026
• getsimplecms-ce GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint CVE-2026-56661 7.5 HighOctober 1, 2026
• getsimplecms-ce GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction CVE-2026-56660 9.1 CriticalOctober 1, 2026
• getsimplecms-ce GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover CVE-2026-53953 9.1 CriticalOctober 1, 2026
• getsimplecms, getsimplecms-ce +1 more GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw CVE-2026-53952 9.8 CriticalSeptember 11, 2026
• getsimple-ce getsimple cms, getsimplecms-ce +1 more GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php CVE-2026-28495 9.7 CriticalMarch 10, 2026
• getsimplecms-ce, getsimple-ce getsimple cms +1 more GetSimpleCMS-CE < 3.3.22 Stored XSS via components.php CVE-2026-26351 4.8 MediumFebruary 24, 2026
• getsimple-ce getsimple cms, getsimplecms-ce +1 more GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability CVE-2026-27202 8.8 HighFebruary 20, 2026
• getsimple-ce getsimple cms, getsimplecms-ce +1 more Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories CVE-2026-27161 8.7 HighFebruary 20, 2026
• getsimple-ce getsimple cms, getsimplecms-ce +1 more GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated) CVE-2026-27147 6.9 MediumFebruary 20, 2026
• getsimple-ce getsimple cms, getsimplecms-ce +1 more GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads CVE-2026-27146 7.1 HighFebruary 20, 2026
• getsimple-ce getsimple cms, getsimplecms-ce +1 more GetSimple CMS RCE in Edit component CVE-2025-48492 8.6 HighMay 30, 2025