Unscored severity · published Jan 16, 2014
CVE-2012-6621
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Email Address or (2) Custom Permalink Structure fields in admin/settings.php; (3) path parameter to admin/upload.php; (4) err parameter to admin/theme.php; (5) error parameter to admin/pages.php; or (6) success or (7) err parameter to admin/index.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GC
Getsimple Cms · Get-simple
through 3.2.3; 1.0; 1.1; 1.2; 1.3; 1.4; +16 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6621
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6621
packetstormsecurity.com
http://packetstormsecurity.com/files/124711
packetstormsecurity.org
http://packetstormsecurity.org/files/112643/GetSimple-CMS-3.1-Cross-Site-Scripting.html
Vendor Advisory
http://secunia.com/advisories/49137
www.securityfocus.com
http://www.securityfocus.com/bid/53501
www.vulnerability-lab.com
http://www.vulnerability-lab.com/get_content.php?id=521
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/75534
More from Getsimple Cms
9.8
CVE-2022-41544
GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php
9.8
CVE-2019-11231
An issue was discovered in GetSimple CMS through 3.3.15
8.8
CVE-2018-17103
An issue was discovered in GetSimple CMS v3.3.13
7.5
CVE-2014-8722
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3)…
6.1
CVE-2020-23839
A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in…