Page 8 of 43 results (0.003 seconds)

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-5356

https://notcve.org/view.php?id=CVE-2015-5356

Cross-site scripting (XSS) vulnerability in admin/filebrowser.php in GetSimple CMS before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the func parameter. Vulnerabilidad de XSS en admin/filebrowser.php en GetSimple CMS anterior a 3.3.6 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro func. • https://github.com/GetSimpleCMS/GetSimpleCMS/commit/cb1845743bd11ba74a49b6b522c080df86a17d51 https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1059 https://github.com/GetSimpleCMS/GetSimpleCMS/releases/tag/v3.3.6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.0EPSS: 0%CPEs: 11EXPL: 3

CVE-2014-8790 – GetSimple CMS 3.3.4 XML External Entity Injection

https://notcve.org/view.php?id=CVE-2014-8790

XML external entity (XXE) vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter. Vulnerabilidad de entidad externa XML (XXE) en admin/api.php en GetSimple CMS 3.1.1 hasta 3.3.x anterior a 3.3.5 Beta 1, cuando está en ciertas configuraciones, permite a atacantes remotos leer ficheros arbitrarios a través del parámetro data. GetSimple CMS versions 3.1.1 through 3.3.4 suffer from an XML external entity injection vulnerability. • http://get-simple.info/start/changelog http://karmainsecurity.com/KIS-2014-17 http://packetstormsecurity.com/files/129778/GetSimple-CMS-3.3.4-XML-External-Entity-Injection.html http://seclists.org/fulldisclosure/2014/Dec/135 https://github.com/GetSimpleCMS/GetSimpleCMS/issues/944 •

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 3

CVE-2014-1603 – GetSimple CMS 3.3.1 - Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2014-1603

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php. Múltiples vulnerabilidades de XSS en GetSimple CMS 3.3.1 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de (1) el parámetro param hacia admin/load.php o el parámetro (2) user, (3) email o (4) name en una acción Save Settings hacia admin/settings.php. GetSimple CMS version 3.3.1 suffers from persistent and reflective cross site scripting vulnerabilities. • https://www.exploit-db.com/exploits/43888 http://seclists.org/fulldisclosure/2014/May/53 http://www.securityfocus.com/bid/67337 https://raw.githubusercontent.com/pedrib/PoC/master/getsimplecms-3.3.1.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 22EXPL: 0

CVE-2012-6621

https://notcve.org/view.php?id=CVE-2012-6621

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email Address or (2) Custom Permalink Structure fields in admin/settings.php; (3) path parameter to admin/upload.php; (4) err parameter to admin/theme.php; (5) error parameter to admin/pages.php; or (6) success or (7) err parameter to admin/index.php. Múltiples vulnerabilidades de XSS en GetSimple CMS 3.1, 3.1.2, 3.2.3, y anteriores versiones permiten a atacantes remotos inyectar script Web o HTML arbitrario a través de los campos (1) Email Address o (2) Custom Permalink Structure en admin/settings.php; (3) parámetro path hacia admin/upload.php; (4) parámetro err hacia admin/theme.php; (5) parámetro error hacia admin/pages.php; o (6) parámetros success o (7) err hacia admin/index.php. • http://packetstormsecurity.com/files/124711 http://packetstormsecurity.org/files/112643/GetSimple-CMS-3.1-Cross-Site-Scripting.html http://secunia.com/advisories/49137 http://www.securityfocus.com/bid/53501 http://www.vulnerability-lab.com/get_content.php?id=521 https://exchange.xforce.ibmcloud.com/vulnerabilities/75534 https://exchange.xforce.ibmcloud.com/vulnerabilities/75535 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 1

CVE-2013-7243 – GetSimple CMS 3.1.2 / 3.2.3 Cross Site Scripting

https://notcve.org/view.php?id=CVE-2013-7243

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1.2 and 3.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) post-menu field to edit.php or (2) Display name field to settings.php. NOTE: The Custom Permalink Structure and Email Address fields are already covered by CVE-2012-6621. Múltiples vulnerabilidades cross-site scripting (XSS) en GetSimple CMS v3.1.2 y v3.2.3 permiten a atacantes remotos inyectar secuencias de comandos Web o HTML a través (1) del campo post-menu de edit.php o (2) el campo Display en settings.php. NOTA: La estructura "Custom Permalink" y el campo "Email Address" está recogido en el CVE-2012-6621. GetSimple CMS versions 3.1.2 and 3.2.3 suffer from persistent cross site scripting vulnerabilities. • http://osvdb.org/101922 http://packetstormsecurity.com/files/124711 https://exchange.xforce.ibmcloud.com/vulnerabilities/90191 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •