Description
Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) param parameter to admin/load.php or (2) user, (3) email, or (4) name parameter in a Save Settings action to admin/settings.php.
Exploits (1)
References (3)
Core 3
Core References
Mailing List mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/May/53
Exploit x_refsource_misc
https://raw.githubusercontent.com/pedrib/PoC/master/getsimplecms-3.3.1.txt
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/67337
Scores
EPSS
0.0285
EPSS Percentile
86.3%
Details
CWE
CWE-79
Status
published
Products (1)
get-simple/getsimple_cms
3.3.1
Published
May 14, 2014
Tracked Since
Feb 18, 2026