GetSimpleCMS-CE vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 202614

Newest CVEs

• CVE-2026-71542

  GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php

  GetSimpleCMS-CE · GetSimpleCMS-CE

  High8.7
• CVE-2026-71426

  GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field

  GetSimpleCMS-CE · GetSimpleCMS-CE

  High7.1
• CVE-2026-70650

  GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content

  GetSimpleCMS-CE · GetSimpleCMS-CE

  High8.8
• CVE-2026-56662

  GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request

  GetSimpleCMS-CE · GetSimpleCMS-CE

  Critical9.6
• CVE-2026-56661

  GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint

  GetSimpleCMS-CE · GetSimpleCMS-CE

  High7.5
• CVE-2026-56660

  GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction

  GetSimpleCMS-CE · GetSimpleCMS-CE

  Critical9.1
• CVE-2026-53953

  GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

  GetSimpleCMS-CE · GetSimpleCMS-CE

  Critical9.1
• CVE-2026-53952

  GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw

  GetSimpleCMS-CE · GetSimpleCMS-CE

  Critical9.8
• CVE-2026-28495

  GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php

  GetSimpleCMS-CE · GetSimpleCMS-CE

  Critical9.7
• CVE-2026-26351

  GetSimpleCMS-CE < 3.3.22 Stored XSS via components.php

  GetSimpleCMS-CE · GetSimpleCMS-CE

  Medium4.8