CVE-2014-8722
HighSummary
GetSimple CMS version 3.3.4 allows remote attackers to obtain sensitive information via direct requests to specific XML files.
Risk Assessment
Attackers may gain access to confidential data, potentially leading to further attacks or breaches of user privacy.
Recommendation
It is recommended to update GetSimple CMS to the latest version and secure access to sensitive files.
Other vulnerabilities in GetSimple CMS 3.3.4
See all- CVE-2017-8081High
Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.
- CVE-2026-53952Critical
GetSimple CMS (v3.4.0a and below) and GetSimple CMS CE (v3.3.22 and below) contain a logic flaw allowing unauthenticated attackers to create a new administrator account. The automated control that deletes admin/setup.php after installation is neutralized by a self-exclusion bug, leaving the setup script accessible. As of publication, no patched versions are available.
Original NVD description (English source)
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to (1) data/users/<username>.xml, (2) backups/users/<username>.xml.bak, (3) data/other/authorization.xml, or (4) data/other/appid.xml.