Vulnerabilities

TI-2021-22484 CVE-2021-47870 · GHSA-xcf5-jfw6-6364

GetSimple CMS My SMTP Contact Plugin 1.1.2 - Stored XSS

MEDIUM 55

GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00279 Published 2026-01-21 No fix listed CWE-79

TI-2021-22474 CVE-2021-47860 · GHSA-vhhc-pp7m-qvpp

GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE

HIGH 76

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers.

CVSS 4.0HIGH 8.5 Network No auth User interaction EPSS 0.00276 Published 2026-01-21 No fix listed CWE-352

TI-2021-22394 CVE-2021-47778 · GHSA-6hw4-fq3j-72w9

GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection

HIGH 72

GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01294 Published 2026-01-21 No fix listed CWE-94

TI-2021-22446 CVE-2021-47830 · GHSA-4qf5-7jr3-q9pq

GetSimple CMS My SMTP Contact Plugin 1.1.1 - CSRF

MEDIUM 56

GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00397 Published 2026-01-21 No fix listed CWE-352

TI-2013-06175 CVE-2013-10032 · GHSA-8xw3-pxpv-8xx4

GetSimple CMS 3.2.1 Authenticated RCE via Arbitrary PHP File Upload

HIGH 73

An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.04289 Published 2025-07-25 No fix listed CWE-306

TI-2024-10309 CVE-2024-11125 · GHSA-w85r-9h7p-rv3f

GetSimpleCMS profile.php cross-site request forgery

MEDIUM 64

A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.004 Published 2024-11-12 No fix listed CWE-352

TI-2023-27960 CVE-2023-51246 · GHSA-3fm4-698v-g632

A Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using…

LOW 24

A Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00326 Published 2024-01-08 No fix listed CWE-79

TI-2023-05683 CVE-2023-6188 · GHSA-7q8c-wgc5-qrph

GetSimpleCMS theme-edit.php code injection

MEDIUM 51

A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00972 Published 2023-11-17 No fix listed CWE-94

TI-2023-24705 CVE-2023-46040 · GHSA-r3jr-h9hq-q78g

Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to…

MEDIUM 58

Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via the a crafted payload to the components.php function.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00568 Published 2023-10-31 No fix listed CWE-79

TI-2023-24706 CVE-2023-46042 · GHSA-qj3c-jhpr-p28m

An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via…

HIGH 82

An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.25274 Published 2023-10-19 No fix listed CWE-94

TI-2022-19953 CVE-2022-41544 · GHSA-c599-8gm5-c2jh

GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE)…

HIGH 76

GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.1427 Published 2022-10-18 No fix listed CWE-94

TI-2022-01376 CVE-2022-1503 · GHSA-284m-6732-qrhg

GetSimple CMS Content Module edit.php cross site scripting

MEDIUM 58

A vulnerability, which was classified as problematic, has been found in GetSimple CMS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00659 Published 2022-04-27 No fix listed CWE-79

TI-2021-14813 CVE-2021-36601 · GHSA-c69q-mgj9-mpv4

GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function…

LOW 29

GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00937 Published 2021-08-10 No fix listed CWE-79

TI-2020-14033 CVE-2020-21353 · GHSA-7rx9-2m95-hgp8

A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS…

LOW 25

A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00549 Published 2021-08-06 No fix listed CWE-79

TI-2020-13424 CVE-2020-18660 · GHSA-pc86-jmjr-hvxg

GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter.

LOW 30

GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01285 Published 2021-06-23 No fix listed CWE-601

TI-2020-13423 CVE-2020-18659 · GHSA-qjf6-h5cr-5f46

Cross Site Scripting vulnerability in GetSimpleCMS <=3.3.15 via the (1) sitename, (2)…

LOW 30

Cross Site Scripting vulnerability in GetSimpleCMS <=3.3.15 via the (1) sitename, (2) username, and (3) email parameters to /admin/setup.php

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01298 Published 2021-06-23 No fix listed CWE-79

TI-2020-13422 CVE-2020-18658 · GHSA-mccm-p9hj-f8fq

Cross Site Scriptiong (XSS) vulnerability in GetSimpleCMS <=3.3.15 via the timezone parameter to settings.php.

LOW 30

Cross Site Scriptiong (XSS) vulnerability in GetSimpleCMS <=3.3.15 via the timezone parameter to settings.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01371 Published 2021-06-23 No fix listed CWE-79

TI-2020-13421 CVE-2020-18657 · GHSA-3gp2-fxr9-ph7v

Cross Site Scripting (XSS) vulnerability in GetSimpleCMS <= 3.3.15 in…

LOW 30

Cross Site Scripting (XSS) vulnerability in GetSimpleCMS <= 3.3.15 in admin/changedata.php via the redirect_url parameter and the headers_sent function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01371 Published 2021-06-23 No fix listed CWE-79

TI-2020-13839 CVE-2020-20391 · GHSA-7x6v-w562-gm77

Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1)…

LOW 25

Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00581 Published 2021-06-23 No fix listed CWE-79

TI-2020-13838 CVE-2020-20389 · GHSA-mr8h-c247-6wp3

Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php.

LOW 23

Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00589 Published 2021-06-23 No fix listed CWE-79

TI-2021-09901 CVE-2021-28977 · GHSA-cpjh-h2xv-8gx6

Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding…

LOW 23

Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00506 Published 2021-06-23 No fix listed CWE-79

TI-2021-09900 CVE-2021-28976 · GHSA-g2wx-83fr-2mf4

Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.

MEDIUM 42

Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.07548 Published 2021-06-23 No fix listed CWE-434

TI-2020-13344 CVE-2020-18191 · GHSA-fmh7-q99m-6pp3

GetSimpleCMS-3.3.15 is affected by directory traversal.

MEDIUM 43

GetSimpleCMS-3.3.15 is affected by directory traversal.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02066 Published 2020-10-02 No fix listed CWE-22

TI-2020-15218 CVE-2020-24861 · GHSA-vf6r-32rf-hv67

GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent…

LOW 26

GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00881 Published 2020-10-01 No fix listed CWE-79

TI-2020-14689 CVE-2020-23839 · GHSA-pp7f-4cfh-g7mw

A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the…

MEDIUM 40

A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login cre…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.10459 Published 2020-09-01 No fix listed CWE-79

Vulnerabilities

Filters