CVSS: 9.8EPSS: 55%CPEs: 1EXPL: 3CVE-2019-11231 – GetSimpleCMS - Unauthenticated Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-11231
An issue was discovered in GetSimple CMS through 3.3.15. insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content (PHP code, for example). This vulnerability is triggered by an authenticated user; however, authentication can be bypassed. According to the official documentation for installation step 10, an admin is required to upload all the files, including the .htaccess files, and run a health check. However, what is overlooked is that the Apache HTTP Server by default no longer enables the AllowOverride directive, leading to data/users/admin.xml password exposure. The passwords are hashed but this can be bypassed by starting with the data/other/authorization.xml API key. • https://www.exploit-db.com/exploits/46880 http://packetstormsecurity.com/files/152961/GetSimpleCMS-3.3.15-Remote-Code-Execution.html https://ssd-disclosure.com/?p=3899&preview=true https://ssd-disclosure.com/archives/3899/ssd-advisory-getcms-unauthenticated-remote-code-execution • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2015-5355
https://notcve.org/view.php?id=CVE-2015-5355
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post-content or (2) post-title parameter to admin/edit.php. Múltiples vulnerabilidades de XSS en GetSimple CMS anterior a 3.3.6 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro (1) post-content o (2) post-title en admin/edit.php. • http://packetstormsecurity.com/files/132481/GetSimple-CMS-5.7.3.1-Cross-Site-Scripting.html https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1046 https://github.com/GetSimpleCMS/GetSimpleCMS/releases/tag/v3.3.6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5356
https://notcve.org/view.php?id=CVE-2015-5356
Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter. Vulnerabilidad de XSS en admin/filebrowser.php en GetSimple CMS anterior a 3.3.6 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro func. • https://github.com/GetSimpleCMS/GetSimpleCMS/commit/cb1845743bd11ba74a49b6b522c080df86a17d51 https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1059 https://github.com/GetSimpleCMS/GetSimpleCMS/releases/tag/v3.3.6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 22EXPL: 0CVE-2012-6621
https://notcve.org/view.php?id=CVE-2012-6621
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email Address or (2) Custom Permalink Structure fields in admin/settings.php; (3) path parameter to admin/upload.php; (4) err parameter to admin/theme.php; (5) error parameter to admin/pages.php; or (6) success or (7) err parameter to admin/index.php. Múltiples vulnerabilidades de XSS en GetSimple CMS 3.1, 3.1.2, 3.2.3, y anteriores versiones permiten a atacantes remotos inyectar script Web o HTML arbitrario a través de los campos (1) Email Address o (2) Custom Permalink Structure en admin/settings.php; (3) parámetro path hacia admin/upload.php; (4) parámetro err hacia admin/theme.php; (5) parámetro error hacia admin/pages.php; o (6) parámetros success o (7) err hacia admin/index.php. • http://packetstormsecurity.com/files/124711 http://packetstormsecurity.org/files/112643/GetSimple-CMS-3.1-Cross-Site-Scripting.html http://secunia.com/advisories/49137 http://www.securityfocus.com/bid/53501 http://www.vulnerability-lab.com/get_content.php?id=521 https://exchange.xforce.ibmcloud.com/vulnerabilities/75534 https://exchange.xforce.ibmcloud.com/vulnerabilities/75535 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2013-1420 – GetSimple CMS 3.1.2 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2013-1420
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to backup-edit.php; (2) title or (3) menu parameter to edit.php; or (4) path or (5) returnid parameter to filebrowser.php in admin/. NOTE: the path parameter in admin/upload.php vector is already covered by CVE-2012-6621. Múltiples vulnerabilidades de tipo cross-site scripting (XSS) en GetSimple CMS versiones anteriores a la versión 3.2.1, permiten a atacantes remotos inyectar script web o HTML arbitrario por medio del parámetro (1) id en el archivo backup-edit.php; (2) title o (3) parámetro menu en el archivo edit.php; o (4) path o (5) parámetro returnid en el archivo filebrowser.php en admin/. NOTA: el parámetro path en el vector admin/upload.php ya está cubierto por CVE-2012-6621. GetSimple CMS version 3.1.2 suffers from multiple cross site scripting vulnerabilities. • http://archives.neohapsis.com/archives/bugtraq/2013-05/0005.html http://get-simple.info/changelog https://www.htbridge.com/advisory/HTB23141 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •