Get-simple
Get-simple Getsimplecms: vulnerabilidades y CVE
Get-simple Getsimplecms tiene 21 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE21
Últimos 12 meses4
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-47870 | Media (4.8) | 0.27% | — | 21 ene 2026 | GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize user input using htmlspecialchars(), but this can be bypassed by passing… |
| CVE-2021-47860 | Alta (8.5) | 0.27% | — | 21 ene 2026 | GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a… |
| CVE-2021-47830 | Media (5.1) | 0.40% | — | 21 ene 2026 | GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, can change SMTP… |
| CVE-2021-47778 | Alta (8.6) | 1.3% | — | 21 ene 2026 | GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code… |
| CVE-2013-10032 | Alta (8.7) | 3.7% | — | 25 jul 2025 | An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authenticated users to upload arbitrary files without proper validation of MIME… |
| CVE-2024-11125 | Media (6.9) | 0.38% | — | 12 nov 2024 | A vulnerability was found in GetSimpleCMS 3.3.16 and classified as problematic. This issue affects some unknown processing of the file /admin/profile.php. The manipulation leads to cross-site request forgery. The attack… |
| CVE-2023-51246 | Media (5.4) | 0.33% | — | 8 ene 2024 | A Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page. |
| CVE-2023-6188 | Crítica (9.8) | 0.97% | — | 17 nov 2023 | A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edit.php. The manipulation leads to code injection. The attack… |
| CVE-2023-46040 | Media (5.4) | 0.50% | — | 31 oct 2023 | Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via the a crafted payload to the components.php function. |
| CVE-2023-46042 | Crítica (9.8) | 23% | — | 19 oct 2023 | An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo(). |
| CVE-2021-36601 | Media (6.1) | 0.94% | — | 10 ago 2021 | GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter. |
| CVE-2020-21353 | Media (5.4) | 0.55% | — | 6 ago 2021 | A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module. |
| CVE-2020-18660 | Media (6.1) | 1.3% | — | 23 jun 2021 | GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter. |
| CVE-2020-18659 | Media (6.1) | 1.3% | — | 23 jun 2021 | Cross Site Scripting vulnerability in GetSimpleCMS <=3.3.15 via the (1) sitename, (2) username, and (3) email parameters to /admin/setup.php |
| CVE-2020-18658 | Media (6.1) | 1.4% | — | 23 jun 2021 | Cross Site Scriptiong (XSS) vulnerability in GetSimpleCMS <=3.3.15 via the timezone parameter to settings.php. |
| CVE-2020-18657 | Media (6.1) | 1.4% | — | 23 jun 2021 | Cross Site Scripting (XSS) vulnerability in GetSimpleCMS <= 3.3.15 in admin/changedata.php via the redirect_url parameter and the headers_sent function. |
| CVE-2020-20391 | Media (5.4) | 0.58% | — | 23 jun 2021 | Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets. |
| CVE-2020-20389 | Media (4.8) | 0.59% | — | 23 jun 2021 | Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php. |
| CVE-2021-28977 | Media (4.8) | 0.51% | — | 23 jun 2021 | Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files, |
| CVE-2021-28976 | Alta (7.2) | 7.5% | — | 23 jun 2021 | Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess. |
| CVE-2020-18191 | Crítica (9.1) | 2.1% | — | 2 oct 2020 | GetSimpleCMS-3.3.15 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /GetSimpleCMS-3.3.15/admin/log.php |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.