Vulnerabilities in GetSimpleCMS-CE
15 resultsCVE-2025-48492HIGHGetSimple CMS RCE in Edit componentEPSS 1.0%CVE-2026-27202HIGHGetSimple CMS: Uploaded Files (feature) Arbitrary File Read VulnerabilityEPSS 0.6%CVE-2026-53952CRITICALGetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic FlawEPSS 0.6%CVE-2026-56660CRITICALGetSimple CMS: CSRF, SSRF, and Unrestricted Zip ExtractionEPSS 0.5%CVE-2026-27161HIGHUnauthenticated Information Disclosure via .htaccess Reliance in Sensitive DirectoriesEPSS 0.5%CVE-2026-53953CRITICALGetSimple CMS: Predictable Password Reset Password Allows Administrator Account TakeoverEPSS 0.4%CVE-2026-71542HIGHGetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.phpEPSS 0.4%CVE-2026-28495CRITICALGetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.phpEPSS 0.4%CVE-2026-71426HIGHGetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" fieldEPSS 0.3%CVE-2026-26351MEDIUMGetSimpleCMS-CE < 3.3.22 Stored XSS via components.phpEPSS 0.3%CVE-2026-56661HIGHGetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpointEPSS 0.3%CVE-2026-70650HIGHGetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and contentEPSS 0.3%CVE-2026-56662CRITICALGetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update requestEPSS 0.2%CVE-2026-27147MEDIUMGetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated)EPSS 0.2%CVE-2026-27146HIGHGetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary UploadsEPSS 0.2%