Show filters
4 Total Results
Displaying 1-4 of 4
Sort by:
Attacker Value
Unknown
CVE-2019-16333
Disclosure Date: September 15, 2019 (last updated November 27, 2024)
GetSimple CMS v3.3.15 has Persistent Cross-Site Scripting (XSS) in admin/theme-edit.php.
0
Attacker Value
Unknown
CVE-2018-19420
Disclosure Date: November 21, 2018 (last updated November 27, 2024)
In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but there are several alternative cases in which HTML can be executed, such as a file with no extension or an unrecognized extension (e.g., the test or test.asdf filename), because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php.
0
Attacker Value
Unknown
CVE-2018-19421
Disclosure Date: November 21, 2018 (last updated November 27, 2024)
In GetSimpleCMS 3.3.15, admin/upload.php blocks .html uploads but Internet Explorer render HTML elements in a .eml file, because of admin/upload-uploadify.php, and validate_safe_file in admin/inc/security_functions.php.
0
Attacker Value
Unknown
CVE-2018-17835
Disclosure Date: October 01, 2018 (last updated November 27, 2024)
An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI.
0
