GetSimple CMS vulnerabilities
3 known CVE vulnerabilities in GetSimple CMS, translated and rated.
- CVE-2017-8081High
Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks via calculation of a session cookie or CSRF nonce.
- CVE-2014-8722High
GetSimple CMS version 3.3.4 allows remote attackers to obtain sensitive information via direct requests to specific XML files.
- CVE-2026-53952Critical
GetSimple CMS (v3.4.0a and below) and GetSimple CMS CE (v3.3.22 and below) contain a logic flaw allowing unauthenticated attackers to create a new administrator account. The automated control that deletes admin/setup.php after installation is neutralized by a self-exclusion bug, leaving the setup script accessible. As of publication, no patched versions are available.