Login Request a demo
GE
Product
GetSimpleCMS-CE
by GetSimpleCMS-CE · last CVE Oct 1, 2026
15
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Vulnerabilities15In the news0Timeline
Severity mix
Critical 4High 8Medium 3Low 0
Severity
All severities15Critical4High8Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add GetSimpleCMS-CE to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-53952
9.8
1%
Sep 11
GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
Affected: <= 3.3.22
CVE-2026-56662
9.6
0%
Oct 1
GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request
Affected: < 1.5
CVE-2026-56660
9.1
1%
Oct 1
GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction
Affected: < 1.5
CVE-2026-53953
9.1
0%
Oct 1
GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover
Affected: = 3.3.22
CVE-2026-70650
8.8
0%
Oct 1
GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content
Affected: <= 3.3.22
CVE-2026-28495
8.8
0%
Mar 10
GetSimple CMS has CSRF to Remote Code Execution via Arbitrary PHP Write in gsconfig.php
Affected: <= 3.3.22
CVE-2025-48492
8.8
1%
May 30
GetSimple CMS RCE in Edit component
Affected: >= 3.3.16, <= 3.3.21
CVE-2026-71542
8.7
0%
Oct 1
GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php
Affected: <= 3.3.22
CVE-2026-56661
7.5
0%
Oct 1
GetSimple CMS: Server-Side Request Forgery in the UpdateCE update endpoint
Affected: < 1.5
CVE-2026-27202
7.5
1%
Feb 20
GetSimple CMS: Uploaded Files (feature) Arbitrary File Read Vulnerability
Affected: <= 3.3.22
CVE-2026-27161
7.5
0%
Feb 20
Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive Directories
Affected: <= 3.3.22
CVE-2026-71426
7.1
0%
Oct 1
GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field
Affected: <= 3.3.22
CVE-2026-27147
5.4
0%
Feb 20
GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated)
Affected: <= 3.3.22
CVE-2026-26351
4.8
0%
Feb 24
GetSimpleCMS-CE < 3.3.22 Stored XSS via components.php
Affected: 3.3.16
CVE-2026-27146
4.5
0%
Feb 20
GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads
Affected: <= 3.3.22
Showing 15