GGetSimpleCMS-CE

Products

Exploited and recent CVEs

• CVE-2026-71542 High 8.7 GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php 0.4%
• CVE-2026-71426 High 7.1 GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field 0.3%
• CVE-2026-70650 High 8.8 GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content 0.3%
• CVE-2026-56662 Critical 9.6 GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request 0.2%
• CVE-2026-56661 High 7.5 GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint 0.3%
• CVE-2026-56660 Critical 9.1 GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction 0.5%
• CVE-2026-53953 Critical 9.1 GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover 0.4%
• CVE-2026-53952 Critical 9.8 GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw 0.6%
• CVE-2026-28495 Critical 9.7 GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php 0.4%
• CVE-2026-26351 Medium 4.8 GetSimpleCMS-CE < 3.3.22 Stored XSS via components.php 0.3%
• CVE-2026-27202 High 8.8 GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability 0.6%
• CVE-2026-27161 High 8.7 Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories 0.5%
• CVE-2026-27147 Medium 6.9 GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated) 0.2%
• CVE-2026-27146 High 7.1 GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads 0.2%
• CVE-2025-48492 High 8.6 GetSimple CMS RCE in Edit component 1.0%